Like most of the rest of the world, the United States has been stumbling its way towards a "papers, please" society in which we must show identification to go about our lives.
asserted
we → stumble → lives
The latest excuse for imposing a national ID requirement is voting, with the stalled SAVE America Act intended to preempt state procedures by requiring people to show REAL ID-compliant documents before casting ballots.
asserted
Act → impose → ballots
Whatever the excuse, we're told identification requirements will make us more secure, but a recent breach of Denmark's national ID system suggests that such an apparatus is just easy hacker bait.
uncertain
apparatus → tell → system
You are reading The Rattler from J.D. Tuccille and Reason.
asserted
You → read → Tuccille
Hackers 'Harvest Records on Approximately 8.8 Million People'
asserted
Hackers → harvest → People
"Denmark is reviewing security controls around its national citizen registry after unauthorized parties exploited a company's access credentials to harvest records on approximately 8.8 million people over a 10-day period," Shweta Sharma of CSO, an enterprise-level security publication, reported earlier this month.
asserted
Sharma → review → CSO
"The breach covers people living in Denmark as well as individuals who have died or moved abroad, while people with protected names and addresses were not affected."
asserted
people → cover → names
The hacker who broke into Denmark's Central Register of Persons (CPR) claims to have entered through a company with access that used "123456" as a password.
uncertain
that → break → password
Danish authorities are scrambling to reassess their security procedures, the implications of the lost data on what seems to constitute almost the entire population, and "whether there may be similar vulnerabilities in other key public IT systems."
uncertain
what → scramble → systems
It's tempting to marvel at the risks inherent in compiling a database of the identifying details of a country's people and then protecting it with the crappiest conceivable password.
asserted
It → marvel → password
But Americans are in a poor position to savor the Danish government's discomfort (though we should sympathize with the concerns of the Danish people) given our own government's comparable screwups.
asserted
we → savor → screwups
In 2015, the federal Office of Personnel Management (OPM) suffered a massive data breach at the hands of Chinese government hackers.
asserted
Office → suffer → hackers
The OPM initially put the loss from the penetration of its background investigation databases on 4 million individuals.
asserted
OPM → put → individuals
Later, though, after a second incident, the OPM raised its estimate to 21.5 million people whose "residency and educational history; employment history; information about immediate family and other personal and business acquaintances; health, criminal and financial history; and other details" had been surrendered to hackers.
asserted
history → raise → hackers
That breach cast a long shadow.
asserted
breach → cast → shadow
Government-provided credit monitoring and identity theft protection insurance for the affected individuals just began expiring earlier this year.
asserted
monitoring → provide → individuals
Frankly, compared to the scale of the OPM data loss, the slightly earlier incident at the Internal Revenue Service (IRS) involving the theft of Social Security numbers, birthdates, and home addresses of approximately 100,000 people almost doesn't register.
asserted
incident → compare → people
A year before those hackers engaged in one-stop information shopping courtesy of federal databases, the Cato Institute's Chris Edwards had warned me that the federal government's vast collection of sensitive data was bound to be abused and misused.
asserted
collection → engage → data
He told me the main "threat is that the vast databases held by the IRS, HHS, security agencies, etc, will be leaked on purpose, leaked because of bureaucrat sloppiness, or be hacked.
asserted
databases → tell → sloppiness
The more they collect, the more that will eventually leak."
asserted
that → collect → more
In fact, two years ago, the Associated Press reported that "a former contractor for the Internal Revenue Service who pleaded guilty to leaking tax information to news outlets about former President Donald Trump and thousands of the country's wealthiest people was sentenced to five years in prison Monday."
asserted
who → report → prison
That leak turned out to involve "the private data of more than 400,000 taxpayers," according to the House Judiciary Committee.
uncertain
leak → turn → Committee
When he was sentenced, the guilty party, Charles E. Littlejohn, insisted he "acted out of a sincere, if misguided, belief I was serving the public interest" by exposing the tax records.
asserted
I → sentence → records
But his motivation hardly matters to the affected individuals who had no choice but to give sensitive information to the federal government, only to see it badly mishandled—as Edwards predicted.
asserted
Edwards → matter → government
In the case of Littlejohn, data was stolen out of a smug sense of outrage over the relative burdens imposed by the tax system.
asserted
data → steal → system
In the OPM incidents, information on federal employees was pilfered by a hostile foreign government.
asserted
information → pilfer → government
In the other IRS breaches, it was apparently taken by criminals seeking to profit.
asserted
it → take → criminals
The Danes may have been lucky, since the people who hacked their national database insist "they had no intention of selling or leaking the data" and may have just sought a challenge.
uncertain
they → hack → challenge
Those affected will just have to hope so.
asserted
Those → affect → ?
As the compromise of Denmark's national ID system demonstrates, centralized databases are tempting targets for bad actors who see in them tempting treasure troves of information if they can only find holes in security—like ridiculous password protection.
asserted
they → demonstrate → protection
The data storage company RackTop maintains a running list of government data breaches in the U.S., updated monthly.
asserted
company → maintain → U.S.
"Several of 2026's largest government incidents ran through systems built to share documents, according to public reporting: a Defense Manpower Data Center file-sharing system, a third-party discovery-transfer tool at the Los Angeles City Attorney's Office, and a SharePoint system connected to DHS's Homeland Security Information Network," the company notes.
uncertain
company → run → Network
ID Requirements Address Some Security Worries While Creating Others
In the U.S., the latest calls for identification documents involve concerns that non-citizens may be casting ballots.
uncertain
citizens → address → ballots
, reliance on the federal government's national ID by another name—the SAVE Act specifies "a form of identification issued consistent with the requirements of the REAL ID Act of 2005 that indicates the applicant is a citizen of the United States"—builds dependency on a hacker-bait system that should itself be recognized as a security vulnerability.
asserted
itself → specify → vulnerability
CSO's Sharma added that the national ID breach is "forcing Denmark to reconsider how CPR numbers are used for identity verification.
asserted
numbers → add → verification
Officials are advising organizations not to rely on a CPR number alone and to use stronger mechanisms such as MitID, two-factor authentication, or one-time codes."
asserted
Officials → advise → MitID
(MitID is a state-run digital identification system in Denmark that also has security flaws.)
asserted
that → run → flaws
Denmark's national ID is no longer considered a reliable means of proving identity.
asserted
ID → consider → identity
Before Americans go further down the "papers, please" road, we should consider whether it poses more risks than benefits.
asserted
it → go → benefits
The Aporia
