Chris Rock

### The Digitization of Vital Statistics Records Modern society relies on government vital statistics registries to establish legal personhood, issuing birth certificates to grant identities and death certificates to terminate them. Historically, recording births and deaths required physical paper forms, in-person notary stamps, and certified physical signatures. Over the past decade, governments in the United States and Australia transitioned these critical processes to automated online portals: the Electronic Death Registration System (EDRS) and Electronic Birth Registration (EBR). In this presentation, security researcher Chris Rock exposes systemic flaws in these digital registries, demonstrating how attackers can remotely declare living people legally dead or manufacture fictional infants from thin air.

### Exploiting the Electronic Death Registration System (EDRS) Rock dissects the operational workflows of state-level EDRS platforms in the United States (such as California's system) and equivalent portals in Australia: - **Physician Certification:** To certify a death online, an individual logs into the state EDRS portal using basic physician credentials. Rock demonstrates that state medical license numbers and physician identifying details are freely accessible through public state medical board registries. - **Funeral Director Registration:** An official death record requires submission by both a medical certifier and a licensed funeral director. Rock demonstrates how trivially easy it is to register as a recognized funeral director: in Colorado, no formal qualifications were required; in Nevada, filing a $375 fee and basic paperwork was sufficient; and in Australia, online registration was approved via automated email within three days without phone verification or physical inspections. - **Cause of Death Formats:** Attackers can utilize standardized CDC death-certification manuals containing dozens of diagnostic templates (e.g., pulmonary embolism, hepatic failure) to draft convincing, medically plausible death submissions that pass administrative scrutiny without triggering mandatory coroner autopsies.

### Fabricating Virtual Humans via Electronic Birth Registration Turning the process in reverse, Rock details how electronic birth registration systems can be manipulated to generate fraudulent, fully recognized legal persons: - **Home Birth Exploitation:** By exploiting regulations designed for home births and midwife certifications, an attacker can register the birth of a fictional child online. - **Legitimate Identity Creation:** Once an electronic birth is accepted, the government automatically issues a genuine birth certificate and assigns a brand-new, valid Social Security Number (SSN). - **Virtual Personhood Lifecycle:** The attacker can age this "virtual human" over years, acquiring credit cards, establishing bank accounts, applying for loans, or registering offshore corporate shells. When the synthetic identity has exhausted its utility or accrued maximum debt, the attacker uses the EDRS portal to file a death certificate, legally closing out the entity and collecting on life insurance policies.

### Weaponizing Official Death for Fraud and Sabotage The real-world consequences of being declared dead in official databases are catastrophic and instantaneous: - **Automated Financial Annihilation:** Vital statistics systems automatically propagate death notifications to the Social Security Administration's Death Master File (DMF), commercial credit bureaus, banks, and tax authorities. Within days, the victim's bank accounts are frozen, credit cards cancelled, driver's licenses invalidated, and passport privileges revoked. - **Targeted Sabotage:** Attackers can target political candidates, business competitors, opposing litigation attorneys, or presiding judges. Declaring an adversary legally dead immediately halts court proceedings, disrupts business transactions, and disqualifies candidates from appearing on ballots. - **Life Insurance and Probate Exploitation:** Fraudulent death certificates enable perpetrators to execute life insurance claims or initiate fraudulent probate actions against high-value estates before relatives or the living victim are notified.

### The Legal and Institutional Impossibility of Resurrection Once an individual is recorded as deceased in state databases, reversing the status is an extraordinary bureaucratic nightmare: - **Judicial Dead Ends:** Rock highlights real-world legal precedents (such as the 2013 case of Donald Miller in Ohio), where a living individual appeared in court to reverse a wrongful declaration of death, only for the judge to rule that statutory limitation windows had lapsed, leaving the citizen legally dead despite standing physically in the courtroom. - **Structural Identity Gaps:** The research underscores the perilous reliance on digital identity systems that lack multi-factor authentication, cryptographic signatures, out-of-band verification with families, or biometrics, warning that society has digitized life-or-death authorities without implementing basic cybersecurity protections.

(AI summary — Gemini 3.8 Flash)