Introduction

Artificial intelligence (AI) has enabled the creation of realistic and convincing synthetic identities, such as faces, names, addresses, and biographical details, that can be used for various purposes, such as online fraud, identity theft, cybercrime, and social engineering. These synthetic identities can be generated by websites such as This Person Does Not Exist[1], which uses a generative adversarial network (GAN) to produce realistic but fake faces of people who do not exist in reality. Such websites can be accessed by anyone with an internet connection and a browser, making it easy and cheap to create and use synthetic identities.

Synthetic identities pose a serious challenge for law enforcement, as they can be used to evade detection, impersonate victims or suspects, create false alibis, or manipulate evidence. Moreover, synthetic identities can be difficult to verify, as they can mimic the characteristics of real identities, such as having credit histories, social media profiles, or biometric data. Furthermore, synthetic identities can be combined with stolen or compromised personal information, such as social security numbers, bank accounts, or passwords, to create hybrid identities that are even harder to detect and trace.

This white paper aims to provide an overview of the phenomenon of AI generated identity, its potential impacts on crime and security, and the strategies that law enforcement agencies need to implement to prepare for these types of investigations. The paper will address the following questions:

• What are the main sources and methods of generating synthetic identities?

• What are the main motivations and applications of synthetic identities in criminal activities?

• What are the main challenges and risks that synthetic identities pose for law enforcement?

• What are the best practices and recommendations for law enforcement to detect, prevent, and investigate synthetic identity crimes?

Sources and Methods of Generating Synthetic Identities

The main source of synthetic identities is AI, which can use various techniques to generate realistic and diverse data, such as images, text, audio, or video. Some of the most common techniques are:

Generative adversarial networks (GANs): These are neural networks that consist of two components, a generator and a discriminator, that compete with each other to produce and evaluate synthetic data. The generator tries to create data that is indistinguishable from real data, while the discriminator tries to distinguish between real and fake data. The process continues until the generator produces data that can fool the discriminator. GANs can generate high-quality and diverse data, such as faces, voices, or handwriting[2].

Variational autoencoders (VAEs): These are neural networks that encode and decode data, such as images or text, into a latent space, where they can be manipulated and modified. VAEs can generate data that is similar to the original data, but with some variations, such as changing the facial expression, age, or gender of a person[3].

Style transfer: This is a technique that applies the style or features of one data source to another data source, such as applying the artistic style of a painting to a photograph, or the facial features of a person to another person. Style transfer can generate data that is novel and creative, but also realistic and consistent[4].

These techniques can be used to generate synthetic identities, either individually or in combination, by using various data sources, such as online databases, social media platforms, or public records. For example, a synthetic identity can be created by using a GAN to generate a face, a VAE to generate a name, and a style transfer to generate a signature. Alternatively, a synthetic identity can be created by using a GAN to generate a face, and then using a style transfer to apply the facial features of a real person to the synthetic face, creating a hybrid identity.

Motivations and Applications of Synthetic Identities in Criminal Activities

Synthetic identities can be used for various criminal purposes, such as:

Online fraud: Synthetic identities can be used to create fake accounts, profiles, or identities on online platforms, such as e-commerce, social media, or dating sites, to deceive, manipulate, or exploit other users. For example, synthetic identities can be used to impersonate celebrities, influencers, or authority figures, to gain trust, popularity, or influence, or to solicit money, information, or favors from unsuspecting victims. Alternatively, synthetic identities can be used to create fake reviews, ratings, or feedback, to boost or damage the reputation of products, services, or individuals[5].

Identity theft: Synthetic identities can be used to steal or compromise the personal information, credentials, or assets of real individuals, such as social security numbers, bank accounts, or passwords, to access their benefits, services, or resources. For example, synthetic identities can be used to apply for loans, credit cards, or insurance, to obtain money, goods, or services, or to evade taxes, debts, or legal obligations. Alternatively, synthetic identities can be used to impersonate real individuals, to access their accounts, profiles, or identities, to conduct unauthorized transactions, activities, or communications[6].

Cybercrime: Synthetic identities can be used to conduct malicious or illegal activities on the internet, such as hacking, phishing, or spamming, to compromise the security, privacy, or integrity of systems, networks, or data. For example, synthetic identities can be used to create fake email addresses, domains, or IP addresses, to send or receive malicious or fraudulent messages, links, or attachments, or to bypass security measures, such as captchas, filters, or verification. Alternatively, synthetic identities can be used to create fake bots, agents, or assistants, to interact with or influence other users, systems, or networks, or to perform automated tasks, such as crawling, scraping, or mining data[7].

Social engineering: Synthetic identities can be used to influence, persuade, or coerce other individuals, groups, or organizations, to perform actions or decisions that are favorable to the synthetic identity creator, or harmful to the target. For example, synthetic identities can be used to create fake news, propaganda, or misinformation, to spread false or misleading information, or to manipulate public opinion, sentiment, or behavior. Alternatively, synthetic identities can be used to create fake threats, alerts, or emergencies, to induce fear, panic, or chaos, or to divert attention, resources, or response[8].

Challenges and Risks of Synthetic Identities for Law Enforcement

Synthetic identities pose several challenges and risks for law enforcement, such as:

Detection: Synthetic identities can be difficult to detect, as they can mimic the characteristics of real identities, such as having credit histories, social media profiles, or biometric data. Moreover, synthetic identities can be constantly updated, modified, or replaced, to avoid suspicion, detection, or traceability. Furthermore, synthetic identities can be used in combination with other techniques, such as encryption, anonymization, or obfuscation, to hide or protect their origin, location, or activity[9].

Prevention: Synthetic identities can be difficult to prevent, as they can be easily and cheaply created and used, by anyone with an internet connection and a browser. Moreover, synthetic identities can be generated by using various data sources, such as online databases, social media platforms, or public records, that are widely available, accessible, or vulnerable. Furthermore, synthetic identities can be motivated by various factors, such as financial gain, personal interest, political agenda, or ideological belief, that are hard to predict, control, or deter[10].

Investigation: Synthetic identities can be difficult to investigate, as they can be used to evade detection, impersonate victims or suspects, create false alibis, or manipulate evidence. Moreover, synthetic identities can be used to conduct complex, coordinated, or distributed crimes, that involve multiple actors, locations, or jurisdictions. Furthermore, synthetic identities can be used to challenge, confuse, or deceive law enforcement, by providing false or misleading information, or by claiming innocence, ignorance, or entrapment[11].

Prosecution: Synthetic identities can be difficult to prosecute, as they can raise legal, ethical, or technical issues, such as the definition, identification, or attribution of synthetic identity crimes, the collection, preservation, or admissibility of synthetic identity evidence, or the liability, responsibility, or accountability of synthetic identity creators or users. Moreover, synthetic identities can be used to exploit or abuse the legal system, by claiming or invoking rights, protections, or privileges, that are not applicable, appropriate, or intended for synthetic identities. Furthermore, synthetic identities can be used to influence or interfere with the legal process, by tampering with or fabricating witnesses, jurors, or judges[12].

Best Practices and Recommendations for Law Enforcement to Combat Synthetic Identity Crimes

To effectively detect, prevent, and investigate synthetic identity crimes, law enforcement agencies need to implement the following best practices and recommendations:

Education and awareness: Law enforcement agencies need to educate and raise awareness among their personnel, partners, and public, about the phenomenon, impact, and threat of synthetic identities, and the methods, techniques, and tools to generate and use them. Moreover, law enforcement agencies need to provide training and guidance to their personnel, on how to identify, verify, and handle synthetic identities, and how to use the available resources, such as databases, platforms, or software, to assist them[13].

Collaboration and coordination: Law enforcement agencies need to collaborate and coordinate with each other, and with other stakeholders, such as government agencies, private sector, academia, or civil society, to share information, intelligence, and expertise, and to develop and implement common standards, protocols, and policies, to combat synthetic identity crimes. Moreover, law enforcement agencies need to establish and maintain cross-border and cross-sectoral cooperation and communication, to address the global and multidimensional nature of synthetic identity crimes[14].

Innovation and adaptation: Law enforcement agencies need to innovate and adapt to the evolving and emerging technologies, methods, and trends of synthetic identity generation and use, and to the changing and challenging scenarios and situations of synthetic identity crimes. Moreover, law enforcement agencies need to adopt and employ the latest and best technologies, methods, and tools, to enhance their capabilities and capacities, to detect, prevent, and investigate synthetic identity crimes.

Regulation and enforcement: Law enforcement agencies need to regulate and enforce the legal, ethical, and technical aspects of synthetic identity generation and use, and to ensure the compliance, accountability, and responsibility of synthetic identity creators and users, and of the data sources, platforms, and services that enable or facilitate them. Moreover, law enforcement agencies need to update and revise the existing laws, rules, and regulations, or to create and introduce new ones, to address the specific and unique challenges and risks of synthetic identity crimes[15].

Conclusion

AI generated identity is a new and emerging phenomenon that has significant implications for crime and security, and poses a serious challenge for law enforcement. Synthetic identities can be used for various criminal purposes, such as online fraud, identity theft, cybercrime, and social engineering, and can be difficult to detect, prevent, investigate, and prosecute. Law enforcement agencies need to implement the best practices and recommendations of education and awareness, collaboration and coordination, innovation and adaptation, and regulation and enforcement, to effectively combat synthetic identity crimes.

About the author

FPI Fellow Philip Lukens, is a retired police chief and a policing consultant who writes extensively about policing and artificial intelligence and about many other police-related issues. Click here to read his full bio. To read more of his commentary on AI in policing visit his Substack.

Notes

[1] This Person Does Not Exist (2024) This Person Does Not Exist. Retrieved from https://this-person-does-not-exist.com/en

[2] GitHub (2014) Generative Adversarial Network. Retrieved from https://github.com/topics/generative-adversarial-network

[3] Zemel, R. (n.d.) Variational Autoencoders. Retrieved from https://www.cs.columbia.edu/~zemel/Class/Nndl-2021/files/lec13.pdf

[4] Papers With Code (n.d.) Style Transfer. Retrieved from https://paperswithcode.com/task/style-transfer

[5] Button, M. et al. (2014) Online frauds: Learning from victims why they fall for these scams. Retrieved from https://journals.sagepub.com/doi/10.1177/0004865814521224

[6] DOJ (n.d.) Identity Theft. Retrieved from https://www.justice.gov/criminal/criminal-fraud/identity-theft/identity-theft-and-identity-fraud

[7] FBI (n.d.) The Cyber Threat. Retrieved from https://www.fbi.gov/investigate/cyber

[8] Fruhlinger, J. (2022) Social engineering: Definition, examples, and techniques. Retrieved from https://www.csoonline.com/article/571993/social-engineering-definition-examples-and-techniques.html

[9] Data Zoo (2024) Synthetic Identity Fraud: A Comprehensive Guide. Retrieved from https://www.datazoo.com/guides/synthetic-identity-fraud-a-comprehensive-guide

[10] Dragilev, D (2023) What is Synthetic Identity Theft and How to Protect Yourself. Retrieved from https://www.freecodecamp.org/news/synthetic-identity-theft/

[11] Simons, T. (n.d.) Synthetic identity – a new path for government fraud? Retrieved from https://legal.thomsonreuters.com/en/insights/articles/synthetic-identity-fraud

[12] DOJ (2017) Identity Thief sentenced for using a new form of fraud “Synthetic Identities". Retrieved from https://www.justice.gov/usao-ndga/pr/identity-thief-sentenced-using-new-form-fraud-synthetic-identities

[13] DHS (n.d.) Increasing Threats Of Deepfake Identities. Retrieved from https://www.dhs.gov/sites/default/files/publications/increasing_threats_of_deepfake_identities_0.pdf

[14] Stephanie E. Hampton, John N. Parker, Collaboration and Productivity in Scientific Synthesis, BioScience, Volume 61, Issue 11, November 2011, Pages 900–910, https://doi.org/10.1525/bio.2011.61.11.9

[15] Federal Reserve (2019) Federal Reserve System white paper examines the effects of synthetic identity payments fraud. Retrieved from https://www.federalreserve.gov/newsevents/pressreleases/other20190709a.htm