Understanding Secure ID Card Printing

Consider the airport lines, consider the delays. Then think about the various ways in which your personal space is encroached upon in what used to be a routine trip from A to B. You realize that national security has become the dominant issue of the day, one with profound effects on the economy and our way of life.

Most people would agree that secure identification begins with a photo ID card, a key example of which is the driver's license. While a good photo likeness and a legible signature remain the key features of a photo ID card, those features alone are inadequate today. Issuing authorities now incorporate several additional features to deter counterfeiting, while at the same time making authentication easier and more reliable.

Which is the real Caroline? Counterfeiting is a real-life, significant problem. Increasing use of covert features in ID card production raises the bar.

Counterfeiting of identity documents is a real-life, significant problem. A September 2003 report by the Federal Trade Commission estimated close to 10 million people became victims of identity theft in the U.S. alone. The same report estimated associated costs to victims at $5 billion and costs to businesses at $48 billion. Many fraudulent schemes can wreak serious damage on victims, including impacting their finances, employment, medical records and even tax filing or criminal status.

Clearly this threat of forged identity documents continues to grow worldwide with the widespread availability of image editing software, card printers, scanners, etc. With sensitive personal information so easily obtainable and abused, this poses threats on several levels of security - personal, corporate, as well as national. However, we can take steps to make government-issued IDs more secure and reduce the risk of counterfeiting.

ID card security
True ID card security derives from several sources: card media, security-enabled card printers and other security features. Card media features include surface quality, card durability and other built-in security elements. A security-enabled card printer, such as Zebra's P620, can print finely detailed graphics and reliable bar codes, plus other covert features printed at time of issue. A third element of ID card security is database verification the card printer may be linked to a central archive that records user-selected information, such as personal statistics and photo of the card holder, license number, date, time and place of issue. Finally, ID cards may be secured through various unusual, covert and forensic features.

ID Card Basics

Most government-issued ID cards are fabricated today by direct printing on "composite" credit card sized plastic cards comprising layers of cross-oriented polyester with outer layers of polyvinyl chloride (PVC). Once printed, a tough 0.001” (1 mil) thick polyester laminate is typically applied to protect both sides of the card. Additionally, a number of overt, covert and forensic security features (see section below) in the card stock and laminate combine to deliver a “credential quality” ID card rugged enough to withstand years of use. Finally, there are machine-readable magnetic stripes, bar codes and programmable devices (smart cards) that can provide even more security, plus the means for automatic data checking and database connectivity.

Given all of the above, you might ask why are there continuing problems with card alteration and counterfeiting.

It is true that better ID card construction has raised the bar to the point where alteration capable of withstanding close scrutiny is almost impossible. But that's the problem. There is very little scrutiny of any sort in many instances where, for example, a driver's license is used to validate a person's ID in a point-of-sale transaction. Even the crudest, least subtle alteration may not be detectable by anyone other than trained law enforcement officers within the issuing state. Because there is no enforceable national standard for drivers' licenses, each state is free to a large extent to do its own thing which makes it easier to get by with a fraudulent license outside the home jurisdiction.

However, while you might be able to get away with it when you're out of state, even the feeblest attempt at card doctoring takes some amount of effort and skill. However, would-be counterfeiters have noticed a much less arduous way to create convincing ID cards to just print them from scratch using software and printers similar to those used by the state authorities. And, with even less effort, you can browse the Web for suppliers of fake IDs.

So, if you can't control the supply of software and printers, how can you stem the flood of illegal IDs? The answer lies in controlling the supply of the materials or card media used in ID card production. Optimists might choose to believe in the fundamental honesty of those in the business. Realists prefer to put their faith in rigid control of the materials inventory throughout the supply chain from manufacturer to issuing authority.

Assuming we have our media supply chain under control, let's return now to the practical business of card production in the context of AAMVA security recommendations for drivers' licenses in the U.S. According to AAMVA, there are three distinct classifications of security features, Levels 1, 2 and 3:

Level 1 (Overt features)
These are "first line" validation features, i.e. they can be seen without the use of equipment or special devices. The most frequently encountered Level 1 device is a High Refractive Index (HRI) hologram printed on either the card or, more commonly for drivers' licenses, on the underside of the protective laminate. Recently developed de-metallization and photo polymer holographic techniques now offer enhanced depth, transparency, and fine line detail which most would acknowledge to be practically counterfeit-proof which brings us back to the caveat mentioned above: the need to prevent Level 1 media getting into criminal hands.

Level 2 (Covert features)
Level 2 features are verifiable by simple, inexpensive tests such as visual inspection under a lens or black light (UV), biometric scanning, digital scanning and data base checking. Examples of Level 2 features include: specialized bar codes, micro-printing, and covert background printing that is incorporated in the card design. Many Level 2 features are in the category of “variable data”, printed at the time of issuance.

Level 3 (Forensic features)
The majority of these must be kept secret to remain useful. Analysis of a card having Level 3 features is essentially a post-mortem process, often requiring some dismembering of the card to determine its origin, and to minutely inspect the features for validity. Level 3 devices are images or physical objects that are hidden within the card structure or concealed by special graphic effects on the card surface. Typically, they can be fully validated only by specialized optical scanning devices, or other means of machine-reading data. Level 3 embedded card media calls for the same rigid inventory control as Level 1.

Securing the Card Issuance Process

We've already covered the need for inventory control of the card materials, the key to most of the security features listed above. Now consider the card production system used to make IDs. Can anyone use it? Do you lock the printer up at night? Are there any added printer security features available? Security of the production system is just as important as any other element of the ID process.

As explained above, ID card security comes from a combination of features inherent to the card media, together with*variable features printed at the time of issuance. Zebra offers a complete range of card media and security-enabled printers. We'll look first at the media.

Secure card media
Gone are the days when ID cards could be printed on garden variety PVC stock, with a photo that merely resembled the card holder. In this security-conscious age, government and other large organizations insist on custom designed card media of ever-increasing sophistication. This is for two main reasons. First, the more security features the greater difficulty in counterfeiting. Second, unique features known to the organization's security force are easily validated by the guard on the spot.

Zebra offers card media with assorted security features, any or all of which may be incorporated into custom designs.

First, we make the card very durable. Zebra's card stock has 10 times the flex life of regular PVC cards. It meets or exceeds all international standards for resistance to cracking, permanent adhesion of over-laminate, and durability of image.

Then, we pre-print features that are very difficult to duplicate. This may include UV-visible text and graphics that are visible only when illuminated by a black light (UV) source. Also, user specified text, with deliberate random font changes and misspelling if desired, may be micro-printed as an added security measure. Character height of the micro-printing is five thousands of an inch.

Other pre-printed security choices include Guilloche patterns, serial numbering and micro-graphics. Guilloche patterns feature finely detailed designs with hidden micro-text. Card serial numbering, either pre-printed or laser-etched, adds an extra layer of security when used in conjunction with Zebra's ID/Log database software (see below).

Next, you can customize your own protective laminate using one of three methods: optically variable ink (OVI), metallized holograms or multi-color UV fluorescent. With OVI, the underside of the laminate is pre-printed with optically variable ink. You may also customize laminates with holographic metallization, including embossed microtext. Finally, with the multi-color UV fluorescent option, the underside of the laminate is pre-printed with UV-visible ink in one, two or three colors.

All of the above are either Level 1 or Level 2 features, which means they are plainly visible or, at most, revealed with an inexpensive black light. Two examples of Level 3 features include hidden elements either in the card core or underneath the magnetic stripe. Hidden elements in the card core are invisible in normal light, but are revealed by strong backlighting. These are completely tamper-proof. Similarly, elements may be hidden under the magnetic stripe. Such features are revealed only by scraping away the magnetic material.

Security Enhanced Card Printing
Important security enhancing things you can do at the time of issuance include special printing effects, as well as printing invisible data. The card transport mechanism in Zebra's P620 allows highly accurate card positioning, which results in high-quality color printing and precision details that are difficult to reproduce.

But a card printer's accurate color registration means much more than attractive images. Zebra's P620 is capable of micro-printing text that's unreadable without magnification, in gray tones synthesized from Y, M, and C color passes. You can use this capability to print "gray-on-gray" encrypted data, plus date and time of issue. You can also make counterfeiting even more difficult using a program of intentional errors and random font changes.

It is also possible to print invisible data at the time of issue with media specifically designed for the P620. YMCK color ribbons are available with a fifth panel that is transparent in normal light, but fluorescent under UV. This is a full-size panel, allowing the placement of UV-visible features anywhere on the card face anything from complex graphics to messages such as date of expiration or other permit restrictions.

Two types of UV panels are available...

Added Security with Database Verification
As mentioned earlier, another critical element of ID card security is database verification. Zebra's ID/Log is a P620 driver utility builds a customizable record of card transactions in the printer's host computer for added security. ID/Log records a user-selectable list of data including printer serial number, date, time and location. The data can be uploaded to a central archive, thus providing a means for security officers to validate the card by comparing it with tamper-proof "real data" in the archive.

Card serialization can add another layer of security to the process. Zebra P620 card printers with the magnetic stripe encoder option can be programmed to function only with serial numbered card stock, and also to add serial number to the data recorded by ID/Log.

For example, all cards supplied to an organization using this system are pre-printed on the front or back with a serial number, which is also recorded on the card's magnetic stripe.

The P620 card printer can be configured to accept only serial numbered cards, and will eject without printing any card without the appropriate magnetic encoding. If a valid serial number is detected, the card is printed in the usual way.

The serial number encoded in the magnetic stripe is recorded in the printer's host computer, where it is linked with the license number and other data such as date, time, and location. This data set is available for uploading at any time to the organization's central database. The result: an automatic database link between the ID card and a serial number that the security officer can read on the spot without special equipment. When transmitted to the central database, the serial number can in turn trigger a download to a local terminal. Now, in addition to the usual comparison of photo and subject, it is easy to check instantly the correlation of serial number and credentials.

Added Printer Security with the P620's ID/Key
Finally, we discuss a way of making sure your P620 card printer can be operated only by authorized personnel. The optional ID/Key is a security feature that disables the printer when removed and prevents unauthorized printer use.

The ID/Key is basically a non-alterable memory containing a unique 64-bit serial number. On power-up, this is compared with a serial number stored in the printer's non-volatile RAM. If the serial numbers fail to match, or if no ID/Key is detected, the printer is disabled.

Conclusion

Technology has made enormous strides in relation to ID card security, advancing the production process to the point where IDs can be instantly tamper-evident, and practically impossible to duplicate without access to the media from which they were fabricated. But therein lies the problem … technology can go only so far. Absent one hundred percent control of the supply chain, counterfeiters will have access to the media. If you assume that's going to happen sometime with unacceptable consequences Zebra strongly recommends the use of its special security media. Also, consider the extra measure of security provided by, at a minimum, a selection of covert features printed at the time of issuance, together with a database verification tool such as the P620's ID/Log and card serialization.