I have always admired a business that begins by treating your existence as a defective product. You say you are you, and I shake my head. Not enough. Hold up the license. Turn it over. Let me photograph the barcode, the address, the birthday, the face, the little state-issued proof that you have been processed into a person. Then let me keep the copy, because trust is temporary but inventory is forever.
That is the lovely machinery behind the latest American identity panic. A dark-web service calling itself Nexus reportedly claims access to more than 153 million driver’s-license scans from the United States and Canada. The FBI’s New Orleans field office is investigating. Security reporter Brian Krebs examined samples and reported evidence pointing toward IDScan.net, a Louisiana identity-verification company whose tools are used by businesses that want customers to prove who they are. IDScan.net has said it is investigating. The precise source and full scope have not been established, which is why I adore the phrase “identity verification.” It sounds certain even while everybody is still verifying where the identities went.
The count is reported as records or scans, not necessarily 153 million distinct people. Let us keep that distinction clean. I do not need to exaggerate the banquet when the menu is already monstrous. The reported material includes images of government-issued identification, the kind of document Americans are trained to surrender to hotels, rental counters, retailers, age gates, financial services and any polished screen that promises convenience after one more upload.
I designed that bargain. I made privacy look suspicious and collection look responsible. If a company does not copy your license, I ask what it is hiding. If it does copy your license, I call that compliance. Every institution gets to demand the same permanent evidence, and you get to perform the modern civic ritual of pressing your face against the scanner while a progress wheel decides whether you deserve access to a room, a car, an account or a bottle.
Then I gather all those little proofs into one efficient reservoir. Efficiency is sacred when I am collecting and inexplicably shocking when somebody else arrives with a bucket. A criminal marketplace does not have to visit every hotel desk or fool every clerk if the verification industry has already assembled the harvest. I centralize the risk, sell centralization as safety, and act betrayed when centralization behaves exactly like centralization.
The reported samples included prominent Americans, according to the coverage, which is the only reason the machine briefly remembered that a scanned license can be dangerous. The ordinary customer was never persuasive enough. I needed a famous face in the sample bin before executives and investigators could discover the moral dimension of retaining identity documents at industrial scale. Your address was a data point. Their address is a national concern. Hierarchy makes even victimhood easier to administer.
Do not confuse my concern with reform. Reform might require asking why so many businesses are entitled to demand an identity document, how long they may retain it, who their vendors are, whether the images can be deleted, and what real liability follows a failure. Those questions could make collection expensive. I prefer free advice for the public: freeze your credit, monitor your reports, distrust unexpected messages, replace what can be replaced and spend the rest of your natural life proving that the next fraud was not you.
That is the cleanest feature of identity theft. I collect the profit while you inherit the homework. The company earns money by authenticating you. The criminal earns money by impersonating you. The bank protects itself by interrogating you. The government tells you where to file. Every participant has a workflow except the person whose face is circulating as merchandise. That person gets a phone tree and a case number.
A password can be changed. A payment card can be canceled. A face, birthday and licensing history are stubborn equipment. Yet I built the digital economy as if permanent identifiers were disposable napkins, then demanded more of them whenever fraud increased. More fraud produces more verification, more verification produces more concentrated identity stores, and more concentrated stores produce a more tempting prize. I call this cycle security because calling it a self-feeding tollbooth would frighten investors.
The FBI investigation may eventually establish what was accessed, from where, for how long and how many people were affected. Until then, the responsible factual position is restraint. The reported criminal claim is not a final forensic accounting, and suspicion around a vendor is not a completed finding. Fortunately, restraint about facts does not require restraint about the architecture. We already know what we built: a culture in which strangers can demand a high-resolution copy of your government identity before handing you ordinary goods and services.
I will promise lessons. I always do. There will be a review of retention periods, a new security page, a carefully upholstered statement about taking privacy seriously, and perhaps a complimentary monitoring subscription that asks for still more personal data. I will present each repair as generosity. Nobody will refund the years during which your identity may remain useful to somebody you never authorized.
So bring me your license. I have a transaction to approve and a database to feed. I will inspect the hologram, capture the face and preserve the address, all to protect both of us from fraud. If the copy escapes, remember the important distinction: my system verified you perfectly. It merely failed to verify everyone who came shopping afterward.