FBI Probes Service Selling 153M+ Drivers Licenses • Hacker News Board

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#101

Post by 2legit2quit » Wed, Sep 02, 2026, 9:42 AM UTC

rswail wrote: post #90

The main question to government is: 1. You already know who everyone is. By definition identification as an individual is by government. 2. Why is there not a system that allows a business or other service to ask for government identification that is encrypted and only visible to government, but that allows a business to ask for certain details, required for the operation of the business (eg confirmation of driving l…

> Why is there not a system that allows a business or other service to ask for government identification that is encrypted and only visible to government, but that allows a business to ask for certain details, required for the operation of the business (eg confirmation of driving license, or age)?

Generally speaking, it's the narrative of a pushback on a "national id".

Many countries already have this place. Estonia has the Digital ID provided by government[0]. Nordic countries use BankID, which is a form of KYC that is backed by banks (you prove your identity to the bank, the bank issues a bank id - usually back by certificate[s], and you login with this to services[1][2]). Finland is the outlier, here, with their own service[3].

0 - https://e-estonia.com/service/estonian-e-identity/id-card/

1 - https://www.bankid.com/en/individuals/get-bankid

2 - https://bankid.no/en/how-to-get-bankid

3 - https://www.suomi.fi/instructions-and-support/identification...

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#102

Post by gnz11 » Wed, Sep 02, 2026, 9:50 AM UTC

2legit2quit wrote: post #101

rswail wrote: post #90

The main question to government is: 1. You already know who everyone is. By definition identification as an individual is by government. 2. Why is there not a system that allows a business or other service to ask for government identification that is encrypted and only visible to government, but that allows a business to ask for certain details, required for the operation of the business (eg confirmation of driving l…

> Why is there not a system that allows a business or other service to ask for government identification that is encrypted and only visible to government, but that allows a business to ask for certain details, required for the operation of the business (eg confirmation of driving license, or age)? Generally speaking, it's the narrative of a pushback on a "national id". Many countries already have this place. Estonia…

Yes, which is part of a wider narrative in the US that insists everything must be privatized because the government cannot be trusted or is otherwise incompetent.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#103

Post by wolvoleo » Wed, Sep 02, 2026, 9:50 AM UTC

Ooh I thought they sold that many fake ones lol. I know fake IDs are a big thing in the US because of the really high drinking age (were I'm from it was 16). But even then it's a lot.

But no it's about leaked data. That wasn't very clear from the title.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#104

Post by wolvoleo » Wed, Sep 02, 2026, 9:52 AM UTC

analog31 wrote: post #21

Nition wrote: post #12

The thing that really gets me about this one is that surely you can easily just delete the data after you've verified someone? But instead they decided to keep 153,347,439 of them.

I believe we need to criminalize possession of the data, with statutory damages per violation.

Isn't that the case already? Here in many European countries it already is. They're always warning about that when there's a big breach and people download it to see what's in it about them. Not that they're going to prosecute half the country of course but still.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#105

Post by wolvoleo » Wed, Sep 02, 2026, 9:54 AM UTC

randunel wrote: post #79

vrganj wrote: post #44

Earlier quoted context omitted.

Not quite the same, but the GDPR gives you a right to erasure.

Actually GDPR is exactly what they're asking to. Possession of personal data that is not required for a service's functionality is illegal under GDPR.

Well unless it was stored with freely given permission of course.

But it has to be freely given. "Give permission or you can't use this service" is not ok for data that isn't required to provide the service.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#106

Post by lotsofpulp » Wed, Sep 02, 2026, 10:05 AM UTC

mschuster91 wrote: post #88

londons_explore wrote: post #82

Earlier quoted context omitted.

Estonia has it's ID cards which can sign things.... That suddenly means a data leak doesn't matter - nobody can make new signatures. Verifying someone's ID would be as simple as asking them to sign your company name and today's date.

The problem is... being opposed to a national ID card scheme is bipartisan in the US [1]. The Republicans go as far as to yap about "mark of the beast", the Democrats and the ACLU fear them being used as part of a surveillance state. [1] https://www.nyclu.org/commentary/letter-beware-mark-beast-wa...

A national ID card scheme has existed for many decades. It’s called a passport.

There is no reason a digital equivalent can’t be made using the passport system, and it can be left optional, just like passports are optional.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#107

Post by cucumber3732842 » Wed, Sep 02, 2026, 10:07 AM UTC

Nition wrote: post #12

The thing that really gets me about this one is that surely you can easily just delete the data after you've verified someone? But instead they decided to keep 153,347,439 of them.

No, you can't, because then when the headline reads "FBI probes service selling " and you don't have those records you wind up taking it. And that's before you even start talking about retention laws.

There can be a discussion about retention periods and the like but too short a retention period amounts to "trust us bro" in the eyes of some un-feeling government agency who is trying to screw you either at the behest of the law or at the behest of whoever hates you and has their ear.

Something needs to be done but "just delete it after you've verified it" is not workable at scale. Yes I know it worked fine for brick and mortar forever. Maybe some acceptable technical solution could be reached, idk.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#108

Post by cucumber3732842 » Wed, Sep 02, 2026, 10:10 AM UTC

alistairSH wrote: post #94

mschuster91 wrote: post #88

Earlier quoted context omitted.

The problem is... being opposed to a national ID card scheme is bipartisan in the US [1]. The Republicans go as far as to yap about "mark of the beast", the Democrats and the ACLU fear them being used as part of a surveillance state. [1] https://www.nyclu.org/commentary/letter-beware-mark-beast-wa...

Which is insane. The federal government already knows who we are, via SSN, tax returns, and whatever else. The state already knows via tax returns, driver's license, and whatever else. If we, collectively, don't want a true national ID, then federal regulations on state-issued IDs should be available (something roughly akin to ReadID, but with the ability to use the ID as a proof of age or other attribute as needed).…

>Which is insane. The federal government already knows who we are, via SSN, tax returns, and whatever else. The state already knows via tax returns, driver's license, and whatever else.

"They can already send a drone to watch you and track your cell location and, and, and, why does it matter if they also slap up a million AI powered cameras?"

The comprehensiveness of the system matters.

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#109

Post by subscribed » Wed, Sep 02, 2026, 10:47 AM UTC

wolvoleo wrote: post #105

randunel wrote: post #79

Earlier quoted context omitted.

Actually GDPR is exactly what they're asking to. Possession of personal data that is not required for a service's functionality is illegal under GDPR.

Well unless it was stored with freely given permission of course. But it has to be freely given. "Give permission or you can't use this service" is not ok for data that isn't required to provide the service.

It must be freely given anyway, but its still illegal to keep unless proportional and necessary for the stated purpose.

If the purpose wasn't "we keep to resell it later" it's likely illegal.

Well, "illegal" given that this type of criminality is pretty much ignored (I've been fobbed off by the regulator after pointing a systematic law-breaking by a $company many many many times. Still better than not having this).

Re: FBI Probes Service Selling 153M+ Drivers Licenses

#110

Post by Gander5739 » Wed, Sep 02, 2026, 10:52 AM UTC

2legit2quit wrote: post #101

rswail wrote: post #90

The main question to government is: 1. You already know who everyone is. By definition identification as an individual is by government. 2. Why is there not a system that allows a business or other service to ask for government identification that is encrypted and only visible to government, but that allows a business to ask for certain details, required for the operation of the business (eg confirmation of driving l…

> Why is there not a system that allows a business or other service to ask for government identification that is encrypted and only visible to government, but that allows a business to ask for certain details, required for the operation of the business (eg confirmation of driving license, or age)? Generally speaking, it's the narrative of a pushback on a "national id". Many countries already have this place. Estonia…

https://youtu.be/ZVYqB0uTKlE (Yes, Prime Minister)