For the last decade, governments across the world have followed Financial Action Task Force (FATF)'s mantra: we need full transparency and to identify everyone for security, for "better protection". This statement has not only proven to be a great failure, but it has now become the main weapon against western society and its governments themselves.
On Aug. 31, Brian Krebs reported that a new service on the Russian cybercrime forum Exploit was offering access to digital scans of identity documents on more than 153 million people in North America. The FBI's New Orleans field office has launched an official investigation.
How did more than 153 million identity documents from people in the United States and Canada end up in the hands of cybercriminals selling them on the dark web?
Based on Krebs's interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by idscan.net, a widely-used identity verification company based in Louisiana that processes over 21 million verifications monthly at more than 20,000 locations, serving clients including Hertz, Target, FedEx, and Caesars Entertainment. The data had been continuously exfiltrated for over a year before it was discovered.
For me this is also personal. As someone who has been subjected to the weaponisation of cybersecurity and financial laws by an authoritarian regime for my human rights work seeking to obtain my travel, financial, and communication data across the EU and the U.S., I know exactly what this kind of breach enables.
Travel records, financial histories, and communication metadata are the most sought-after information for physical, economic, or digital attacks by authoritarian regimes and their proxies - we call it transnational financial repression. And I'm endlessly grateful for Mauro Del Barba, Markus Wiechel, Hannah Neumann for leading and pushing for clear remedies against these attacks at the level of the OSCE Parliamentary Assembly, Parliamentary Assembly of the Council of Europe, and European Parliament.
This is real protection of our citizens and entities against cyberattack, not pushing for new aggregation of personal data!
When 153 million identity documents sit in a single database for over a year, undetected, every person in that database becomes a potential target, not just for common fraud, but for transnational repression. Privacy has to be recognised as a fundamental human right, including in the digital space, where the same data that sits unprotected can be weaponised by bad actors and AI-powered tools alike.
This is one more example of the message I'm not going to tire of repeating: the weaponisation of FATF's financial, national security and cybersecurity laws no longer serves as protection.
Time to stop it and implement the most recent resolutions on transnational financial repression NOW.
