back
182 comments
I once met an Irish person who was detained at Beirut Airport when (trying to) leave the country, and who then disappeared into the Lebanese prison system. Really, he just disappeared.

Luckily he was allowed to make a call just after being detained, to his friend who worked for the British Council in Beirut. The friend was tirelessly in searching for him and seeking his release. It wasn’t easy.

(I met him just after his release, while he was building the courage to try again to leave the country.)

Why was he detained? Because his common Irish first name and common Irish surname matched someone on an Interpol list.

Let me guess, he was living in his home address and he was employed. He had no visits by police but when he tried to leave the country no one was bothered who he really was but they were bothered that a not so much friendly UI message has appeared on the screen.
Oh, the classic Tuttle <-> Buttle name confusion!

I always remember the movie Brazil when I have to interact with a stupid cybernetic apparatus like every big company, where simple programs are the brain and low-paid humans are the actuators.

Brazil is one of the scariest films I've ever seen.
This is one of the obvious consequences of not having a national identity number assigned to everyone at birth, which exist in most developed countries, except for anglosphere, for some reason.
Objection to ID numbers as a concept aside, I don't think it actually solves the problem this author faced.

Fake identities are dime a dozen. It is not exactly hard for an illicit entity to just put some random ID numbers it bought off the dark web on its books. And now you have just made it even harder for the people who had their identities stolen to clear themselves. How do you convince some company drone doing sanction compliance that you didn't actually work for Sanction Circumvention Ltd when your ID number matches the one on their company's payroll files?

Not to mention the sanction list is full of foreigners. The American authorities compiling the list aren't going to know what's the national ID of a random Russian or Iranian guy running an import business. So what is going to happen if your name matches someone who's on the list with a blank ID field? Probably the same thing that happened to the author, I guess.

How so? The article is talking about a fictitious person that's listed by name only on a sanctions list despite the government knowing the person doesn't exist. There is no possibility of the real Sean Byrne presenting a government number that is a negative match against the list because the fake Sean Byrne has no known ID to match against. The essence of the entry is just "here's a name to avoid".

The real Sean Byrne can produce a government-issued passport number, but that's clearly not enough for Apple.

I think it's more of a problem of all these "hyperscale" platforms where the cost of not being zealous enough is long litigation and devastating fines, while the cost of losing a single customer (or a thousand) is basically nil. This leads to all kinds of opaque, customer-hostile outcomes like this, also if you trip some filters not related to sanctions / mistaken identities. There's a recurring theme of HN posts along the lines of "an automated process at Google cut my business off, HN plz help".

in Egypt, every person is born with a universal national ID number , which is standardized everywhere here, but it created some problems, it became extremely valuable to attackers. If leaked, it can be reused across completely different services ( and you can never change it under anycase )

Having the full name + national ID was enough to bypass verification and activate various services, and many people weren't tech savvy enough to realize how dangerous it was to share or leak that info

I'm from Greece, where I have a national identity number. In fact I've had several (maybe half a dozen?) national identity numbers. You see, the national identity number is, literally, the number on your national identity card, or in other words the serial number of the document; not the person. When the document changes, the number changes with it.

Same as with passports. Even in the Anglosphere people have passports with passport numbers. They could be used to uniquely identify the passport holder, except of course there are many passports, and therefore, many numbers, for each passport holder.

Small problem? Just update whatever database is holding the information for sanctionted persons (or, indeed, persons who should not be sanctioned)?

Turns out, that is not a small problem.

Its not as if it even helps since the numbers can be leaked and stolen and then abused & the situation ends up even worse since it is so centralised.
How the identity number would help? It's not like terrorists tell each other their identity numbers. So if the LEOs learn about a terrorist guy that goes around under the name "Sean Byrne", how would they know which ID number that is? And even if I needed some ID number to put on my fake documents, it's easy to download one of the dozens data dumps on the darknet now, and just use any of the IDs there. The LEOs then have a choice - put that number into their ban database (therefore banning some innocent person whose only fault is that he made a mistake of participating in the economy) or go just by the name (which is not better). Don't see how it changed anything.
Ireland has a PPS number which everyone who’s ever had a job or claimed government benefits has. The union of those sets is basically everyone. Clearly that hasn’t helped.
He has a passport with a number on it. Why isn't that sufficient? There are also multiple countries involved in this story.
That doesn't work unless everyone is always referred to by that number. All it takes is a "credible" information on some database that says you're the other Sean Bryne, now with the related national ID.
America has social security numbers. U.K. has national Insurance numbers, Ireland had a PPS and Canada has an SIN
National ID numbers will not help with cross border situations like this.
No, the problem is the due-process-free list of government-designated undesirables
I mean in theory, it doesn't have to be a serial number, and I think that's better. Something about it suggests being enlisted in a national army.

It says the state assigns "A body" a number.

-vs-

The state is made up of us as individuals.

So while the serial keyfield is a data engineers dream, politically I'd welcome something more personal.

Time of birth/parents and other identifying information is on our birth certificates in the UK. Concatenate some of that.

I could be.

DavidAndrewEvans-01011980-0036-MRI-JeanDavis-AlexEvans

Name-DOB-TOB-LocationCode-Parent(s)

Location of Birth like an airport code - MRI (Manchester Royal Infirmary), Parent(s)... i mean we can use their birthdates too.

I actually quite like the idea of it. It seems intrinsically validating to a person to identify them in this way.

UUIDv7 for all!
Tony Blair joined the chat
Something like this happened to me and it has cost me $20k+ over time, https://areoform.wordpress.com/2021/08/06/on-apples-expanded...

Mercury unblocked my accounts because their founder is a very kind man who bothered to verify what the document actually says rather than falling back to, "Computer says no." But everywhere else? De nada. Computer says no.

And it's not even me. It's a fuzzy match with someone in their 50s. Doesn't matter. Computer says no.

And I can't "get off the list" because it's not me who's on the list. The computer will always say no.

In the long run, I'll be fine. I think. But I'll pay $100k+ by the time it's over. These systems are being steadily expanded, as the dumbest incarnations of themselves. We've gone from Thin Thread https://en.wikipedia.org/wiki/ThinThread to crappy fuzzy matches on shoddy data executed on with 0 diligence. It's the stupidest possible timeline.

I think many, many other people will be sharing our fate soon, which is partly why I've been writing about this slow rolling train wreck in motion in bits and pieces.

This scares me! Denial of service (in some cases you may not even have an alternative), in some cases custody, et cetera and that too based on a false positive or a flimsy match. And no one doubles checks it, no one bothers to make sure, and they are allowed to do that! All this is actual legal and no one pays for it once it's found out, and even if you have suffered. None.

And heaven's forbid if your actual ID and references (i.e you) have ended up in such places (or such list/s) by mistake or malice.

I believe this real Sean Byrne should move into Sligo for a while, just to spice it up a little. Then they can also ask to be removed from the list as the person on the list.
This has been going on for a long time. In the early 2000s I knew someone with the relatively common name Ian Smith who was routinely held up in airports because someone else with that name was on a watch list. I think in the end he managed to get some kind of stamp in his passport that officially said "not that Ian Smith", and it seems mad this isn't easier to resolve these days.
You can't seriously match people on first and last name and claim "fully matched".

Think of how manny John Smiths there are?

How can this be the company started by Wozniak and Jobs ...

The App Store as the only way to install apps is the worst part about iOS and why I'll never use it again.

I'm always helping friends with piracy and I have to tell them they can't conveniently use a native app because it isn't listed on the App Store.

And then there's the removal of ICE apps.

It's too much control. On iOS, if the government banned Signal, Apple could enforce it. On GrapheneOS, you can use whatever app from anywhere no matter what.

Not exactly the same still i would like to share my horror story.

Google decided to ban my many years old account. Reason: account created by computer program. Likely flagged me because i use multiple computer and connect from other wifi.

Whats worse is i am a monetized youtube partner with million+ views. Youtube support (@TeamYoutube) just say "it is a google problem"

All appeals are handled by bots, there is no way to reach an actual human being.

We are being controlled by our ai overlords. Some bot on some cpu can ruin your life on a whim.

What makes me kind of angry is this is a totally and easily fixable problem but for whatever reason, the people who could do something about it have no desire for improvement and would happily let the cost and inconvenience continue.

Not one single person in that system thinks the very obvious "A name without any other data is worthless, let's just delete it from the list".

If people lack agency then you already have an ineffective system but my guess would be that no-one person has the authority to take executive action and every change however daft takes 30 people in a meeting discussing it for an hour so it just gets left as it is.

One option might be for the real Sean Byrne to move to the address in Sligo of the fictitious one, then ask to be removed from the Entity List on the grounds that he is a real person. I think that wouldn't work, and could be life-changing in a bad way, but it's an idea.
I got temporarily banned from the Sun Java Forums years and years ago because of something like this. I tried creating a few test accounts and it seemed to be the first name, not even the full name, that was the "match" ! I assume someone on the list had an alias of just "Dave" or "David" and whoever implemented the filter had just done the easiest thing possible.

Not really a life-altering inconvenience, and the other forum members got sufficiently uppity that they re-reviewed it and let me back in, but it was a good lesson in how big orgs have no innate common sense.

The reason Apple or Google or Microsoft don't care one way or the other is their directors rarely if ever suffer from their policies. We should try to make them.

The way to retaliate against those stupid lists and the stupid way they are enforced by US companies could be to register a fake company with principals named Tim Cook, Satya Nadella, Donald Trump, etc. (and many other people with less well-known names, but high up in various organizations) and somehow get that company and all its employees' names on a sanctions list?

Not sure what it would take to work, but it would probably be fun.

Honestly the best thing to do might be to change your name at this point. I'm glad my name is not common, this kind of issue is going to only get worse in the future.
Background check softwares do this too.

Some of the low cost options now a days do not have human in the loop. They often miss obvious red flags or do too much false positives.

I assure you there are several Sean Byrnes in Sligo, and at least one in Drumcliff
> Asked about it, the head of the FBI’s Terrorist Screening Center said Robert Johnson would never get off the list, and that anyone with the name would be inconvenienced every time they tried to check in.

(Said person was already in prison.)

So essentially, the federal government and three letter agencies are propagating the crime. The original person did something which presumably violated other people’s rights. Now the federal government continues to violate people’s rights by essentially lying about who’s actually a threat.

I used to own a very small, very niche retail business that produced a specific part for analog synthesizers. I had customers in literally nearly every nation on earth, and I was surprised by how many times I received returned package for shipping to a person who was “sanctioned” by the US Government. It was probably something like 1 out of every 100 packages. In each case, the person on the receiving end was surprised to hear about the sanction and I honestly believe most were mistaken identity like the article in this post. When it happens, it’s nearly impossible to do anything about it.
Imagine now incorrectly being on the no-fly list. It requires no conviction and has no appeal.
I found some very intriguing/disturbing things while I was paying for full access on Ancestry.com. Those genealogy sites have powerful searches over a lot of public-records databases if you pay them enough. So naturally, I investigated myself.

One of the biggest mind-benders was finding a person with a string of addresses going back 25+ years. Now I've lived in this area for 27, and for some reason, this person's addresses all coincided with mine. They had lived near every residence I ever had; they lived within a stone's throw of every clinic, every church, my college, every place I had a relationship with. One such person's "last known address" was an exact match for my previous address: apartment number and all. I found a profile on Facebook but it is unknown if these are real persons, or fictitious entities in the public record for some purpose.

Then, I found a person who seems to be real (has a Facebook profile with photo, lists a real place of employment, etc.) She shared my exact surname and had a given name that matches my ethnicity. She lived at the same street address for a long time, albeit a different apartment number. I was receiving mail for her.

At some point, this phantom wife/sister was conflated with me in the public record. Obviously someone got her unit number wrong if I got her mail. But my phone number was eventually listed as hers. She has found herself in debt, and is sometimes referred to a collection agency. I've gotten no less than 3 separate inquiries for delinquent debts, that are clearly not mine, that start coming through because her contact info is utterly conflated with mine, and apparently no valid, current info is giving them any leads.

The crazy thing I learned last year is that a collection agency doesn't need to divulge any details of the debt they hold to the person they contact. It is incumbent on the contactee to verify whether they reached the wrong person. I began following CFPB instructions on disputing the debt, but the collections agency clammed up and refused to answer any questions until I answered theirs (registered on their website, divulged a lot of PII). However, the joke's on them, because it is very easy to review credit reports and determine whether a debt is or isn't on my own record.

>The Robert Johnson they kept being confused with wasn’t a man named Robert Johnson. It was a known alias of someone convicted of plotting to bomb a Hindu temple and a cinema in Toronto

Also, sold his soul to the devil at a crossroads, so you gotta be careful.