Credentials--Bona Fide or False
APPROVE FOR RELEASE 1994
CIA HISTORICAL REVIEW PROGRAM
2 JULY 96
Glimpses into the meticulous work of those who examine identity papers for forgery or falsehoods.
CREDENTIALS--BONA FIDE OR FALSE?
David V. Brigane
The use of false documents, traditional in espionage, has responded like all else in the profession to the modern trend of expansion, organization, and technological advance. As intelligence activities have multiplied, the demand for documents has grown, and increasing effort has gone into their procurement and manufacture. On the defensive side, the detection of false documents has undergone a parallel growth in importance.
Those not familiar with false documentation would be amazed to see the elaborate techniques that go into the making of a high-grade reproduction and startled by the perfection of the results achieved. German World War II reproductions of British pound notes were so accurate that a Swiss bank, asked by German agents to check them as possible forgeries, had no reservations about declaring them authentic. The bank had not been remiss: it had made a careful examination and cabled London to verify the serial numbers and dates. After an extended period of use it was no physical flaw but merely the unavoidable duplication of existing serial numbers that ultimately gave them away. More recently a Western security service accepted a reproduction of its country's passport as genuine even after the question of forgery was raised.
But false documentation is an uneven business. Requirements on it are unpredictable, its raw materials often unavailable, and the time interval between demand and delivery can be appallingly short. The perfection of high-grade reproductions is no less astonishing than the crudity of makeshifts sometimes used even by the intelligence services of major world powers. Documents prepared by the German secret services during World War II have been described as being in many instances "beneath contempt" and "veritable death warrants to their unhappy holders."1 Japanese documentation specialists, examining German reproductions of the Russian basic identity document, noted that the cloth cover was too light, the printing ink too glossy, the multi-colored background tint made by the Zammel printing press noticeably brighter than it should be, and the place-of-issue indicator identical in all copies.
Soviet Agent Documentation
The Russians themselves have not been above using some of the crudest devices known to the forger's trade. In reproducing rubber stamps for the German military travel permit they economized by making a separate stamp for the center emblem and combining it with various reproductions of the outer portion, which showed the place of issue. The composite cachets, of course, did not reflect the individual variations characteristic of the originals, did not have the emblem in proper alignment with its encircling legend, and even showed inking differences from the separate imprintings. But although the Soviet services have thus improvised under the pressure of operational needs, especially in wartime, gambling that their makeshifts will escape close scrutiny, they are nevertheless journeymen at the documentation trade, having long since passed their apprenticeship.
The Soviet emphasis on clandestine and deep-cover activities has historically made documentation of its agents a matter of prime importance. As Don Levine's new book recalls,2 a false Canadian passport was successful in establishing an identity for Trotsky's killer, even though the NKVD has misspelled the name as "Jacson." Richard Sorge used forged passports to conceal his travel to Moscow, and his radio operator, Max Klausen, traveled on three passports, Italian, Canadian, and German.3 Documents were a major concern to Alexander Foote and other members of his net. Rudolf Abel used an altered American passport for entry into the United States and two birth certificates to create different identities after his arrival; his assistant, Hayhanen, built an elaborate identity structure on an original American birth certificate apparently confiscated from a U.S. citizen who had emigrated to Estonia.4 Khokhlov,5 Wolwebber, and "Witczak" relied on documents to support false identities. But if documents were of critical importance in these famous cases which now happen to be in the public eye, imagine the documentation requirements created by the countless throng of subordinate agents and couriers, the proletariat of Communist espionage hierarchies.
To meet this continual demand, the Communists have always devoted a major effort to document collection and forgery. Even in the early thirties they operated a documentation unit in Moscow, one in Berlin, and a third in the United States.6 Of these three the German Pass-Apparat was the most elaborate, with six workshops and agencies all over Europe. In Germany alone there were agents for document collection in each of 24 districts. Their sources were varied. Communist sympathizers sometimes offered their own personal documents. A cleaning woman at Berlin police headquarters stole blank passports for the Party from time to time. Two engravers at the Stempel-Kaiser plant provided duplicates of rubber stamps manufactured for the German government. Two Saarland police officers formed a partnership in passports, one supplying the blanks, the other the stamps. Once during these years a Communist raid on a Czech police office yielded 1500 Czech passports as a by-product, but the richest document hauls in the thirties came from the International Brigade in Spain. Later, during World War II, Max Habijanic, a Swiss police officer in Basel, was a reliable source of backstopped Swiss passports. Currently the Soviet intelligence services use documents of their own Bloc extensively to authenticate defector and refugee cover. They also maintain a systematic watch within the Bloc for foreign identity documents held by returned émigrés.
As a corollary to these Communist activities, Western intelligence services have given increasing attention to the counterintelligence aspects of documentation. Techniques of document analysis developed in scientific criminology have been combined with world-wide intelligence resources to serve the investigative needs of intelligence organizations. Document analysis has been found increasingly effective as an aid in the investigation and detection of enemy agents, in the surveillance and control of one's own agents and verification of their intelligence reports, in the screening of refugees and defectors, and in developing biographic information and establishing the bona fides of individuals of intelligence interest.
Among the odds and ends of intelligence debris deposited during World War II by the tide of battle in Burma was a Japanese document bearing the title "CERTIFICATE OF RELIABILITY." It contained a detailed description of the bearer, followed by this text: "Please extend every assistance, to Mr. Aung since he is employed by us as a spy." Although a spy's normal documentation does not resemble the forthright Mr. Aung's in advertising his profession, it often holds hidden evidence against him. Document analysis can play a key role in uncovering enemy operations.
The nature of this role can be illustrated in the case history of a Soviet escapee, whose documents and statement, in accordance with standard practice, were subjected to analysis and evaluation. During examination of the documents for format, an abnormally small spacing between the abbreviation "No." and the serial number of his basic identity document, the pasport, attracted attention. No pasport from the same place of issue being available for comparison, an analysis of the imprint was undertaken. It was determined that the serial number had been added after the document was printed and bound, contrary to all normal procedures for manufacturing the pasport. Then the signatures came under suspicion, two signatures by each of two officials, because both pairs showed undue similarity. Subjected to handwriting analysis, all four proved to be traced forgeries.
Now the pasport was checked against the escapee's military reserve document, and an irregularity in the photographs became apparent. Normally the photos in the two documents would have been taken on different occasions and would show different poses, clothing, and lighting. It does sometimes happen that prints for both documents are made from the same negative, but then the print used in the pasport is differentiated by a white corner. In this case it was found that the photo in the military reserve document had been copied from that in the pasport but enlarged and cropped to eliminate the white corner. Such rephotographing from another document, generally inconsistent with legitimate issuance, may be necessary when a forged document should show the person at an earlier age or when because of time, distance, or security considerations the subject is not available to the forger for photographing in person.
In addition to these evidences of forgery, discrepancies were found between the information given in the documents and biographic data supplied by the escapee himself. In the use made of these discoveries this case was a typical one. While the results of document analysis did not prove conclusively that the man was a Soviet agent, they showed that his documents had not been issued legitimately, disproved his general story, and opened up specific lines of interrogation and investigation.
As a tool in the investigation of enemy agents, document analysis can be used to great advantage not only in making an initial detection but in the handling of known agents, inducing them to talk and confirming or refuting their statements. The material evidence from documents has a strong psychological impact in corroborating or disproving an agent's story, and can be effective in destroying his self-confidence and eliciting confession.
Agent Control and Other Applications
Document analysis is not reserved for enemy agents; it can be equally valuable in determining the reliability of one's own agents and in assessing their reports and missions. A Far Eastern case will serve as illustration, one wherein an agent's report and the authenticity of a Chinese Communist document on which it was based were tested by analysis.
As evidence of mission accomplished, the agent had also presented, along with the questioned document, the forged travel permit supplied him for use in the target area, now bearing a Chinese Communist cachet stamped on, by his account, at a checkpoint in the area itself. There were no known authentic exemplars with which to compare either the questioned document or this precise checkpoint cachet, but the cachet was compared with others from the same general area. It appeared to follow the normal pattern; several of the examples on hand were similar in format. One of them, however, was especially similar, to the point of suspiciously close likeness. Photographic comparison proved that both cachets had been stamped with the same instrument, and the place names separately imprinted.
Legitimate use of the same stamp in two different localities was out of the question. Fraudulent use of an authentic stamp in Chinese Communist hands was also out; this agent had no such capability. The answer was obvious: both cache were forgeries. Since the exemplar cachet had been obtained from another agent travel permit, all papers connected with the mission this one had been used for came under scrutiny. Among them was a document, allegedly procured in another target area, which bore a small cachet of receipt in a Chinese Communist office. Here again economy of effort betrayed the forger's hand. This cachet proved to be identical with a receipt cachet on the questioned document in the current case, although the receiving offices could not have been the same. It was clear that neither of the reported missions had been carried out and that the documents allegedly acquired in the target areas were fabrications.
In a similar but simpler case, an agent presented a letter which bore a postal cancellation as proof that he had been in a certain city. This time, however, many authentic examples of postal cancellations from the city in question were available for comparison. Examination of the lettering, dating, inks, and indicators conclusively proved that the cancellation was a forgery.
Document analysis is useful in many other kinds of personal investigation--for establishing the bona fides of refugees, for surveying the activities of target personalities, for clearing prospective recruits, etc. Sometimes it is not a question of establishing authenticity, but only of developing informational content. An itinerary analysis from a passport, for example, provides detailed information on a person's movements which may not be procurable from any other source. Culling information of this type might appear to be a simple matter of reading the record, not involving analysis; yet it requires thorough familiarity with travel regulations and the customary passport entries to get the maximum amount of information. In one recent case where little proved biographic information was available on a person, his detailed record dating back to 1931 was built up through documents.
False documents are brought to attention through observation of some defect in them, through improper use, or through suspicion about the situation or activities of the bearer. Analysis can come only after the initial spotting, and relatively poor documentation can frequently escape detection if used in an ordinary way under circumstances which do not attract attention. Anyone who has experienced the harried formalities of an international port of entry must be aware that a passport flaw could well be passed. For where the vast majority of the documents are genuine and the circumstances of use normal, only an obvious flaw will give the document away.
The obviousness of a flaw, however, is relative to the acuity of the checker. The human mind and senses make astonishingly fine distinctions, often unconsciously, in dealing with familiar things. And the results of analysis can be used to increase the checker's sensitivity and so play a part in the initial spotting.
Checklists of irregularities indicative of forgery have long been a counterintelligence tool. During World War II Soviet intelligence prepared a list of indicators for reproductions made by the German Abwehr. One of the salient signs was the use of rustproof staples in the Abwehr reproduction of the Ukrainian basic identity document, a gleaming evidence of forgery. More recently such checklists have been useful in screening Hungarian refugees. In another part of the world, analysis of South Korean documents reproduced for North Korean agents has revealed characteristic flaws and even made it possible to differentiate among those forged by different North Korean intelligence units.
Aside from characteristic individual flaws, patterns in the documentation of enemy agents can be detected by analysis and set up as spotting devices to be used in screening large groups of people. Some underlying pattern is likely to reflect the basic constants in operational needs and aims and the limitations of human imagination and material resources for support of operations. For one thing, there is a tendency to simplify false documents, since greater variety and complexity mean greater chance of error in detail. The resultant simplification may lead to the establishment of more specific detectable patterns. Take for example the question of showing a military career. A fictitious military background is complex and would require elaborate training to maintain under interrogation. The simpler solution of giving no military background has been noted in the documentation of numerous Soviet agents. Lack of military background may therefore be one element of pattern.
The effort to conceal information of value to the opposition may account for other elements of pattern. When the Communists use defector or refugee cover, the agents' documents themselves are of considerable value to Western intelligence. The Communists, operating under the assumption that these Bloc documents will be exploited by Western intelligence services, have introduced slight defects in them, presumably in the hope that these will be reproduced in documents for Western intelligence operations and thus serve to identify Western agents.
One of these defects is the separate imprinting of the pasport serial number noted in the case of the Soviet "escapee" we examined earlier. Other deception devices have been added letter, asterisk, or period, differences in printing impression, fabricated registration and deregistration cachets, and an additional dry seal not used in legitimate documents. On Communist service has shown a pattern of suppressing serialization information by not recording the number of a previous document as "basis for issuance."
But the Communist services risk being trapped in their own dialectic. This technique has been noted and turned antithetically to counterintelligence profit by the West: intentional irregularities are carefully watched for and when found incriminate the document holder. And their detection is facilitated by their tendency to follow a general pattern.
If, on the other hand, the Communists use the documentation of a neutral or enemy country, the limitations on their resources for such documents may set a noticeable pattern. After the Communist raid on the Czech police office back in the thirties, the windfall of Czech passports was used freely until French police became aware of the pattern of Czech passport holders unacquainted with their native language.
For all these potential aids to document checkers, it must be admitted that the counterintelligence function of providing them data for the identification of forgeries has in general not been well developed. This is evidenced by the fact that the average official whose duties include checking personal documents is surprisingly uninformed even about the characteristic features of domestic documentation. The systematic Japanese do go so far as to provide police with pocket-sized booklets listing the blocks of numbers assigned to provinces for Japanese Alien Registration Certificates and describing some elementary characteristics of forgeries; but these rudimentary aids did not prevent the Tokyo Metropolitan Police from being taken in by a Tokyo-issued Alien Registration Certificate carried by a self-acknowledged North Korean agent. Only the agent's insistence that he brought the document from Korea led the police to request an analysis by Printing Bureau experts, which proved the document a forgery.
Another Far Eastern country, less methodical, is also perhaps more typical in its lack of attention to the counterintelligence aspects of documentation. It gives its police officers little or no assistance in detecting forgeries of the basic identity document of its capital city, although an excellent device is at hand. Genuine documents in use in the city have come from thirty or more different printing plates made up from time to time when additional stocks have been needed and the old plates were no longer available. No attempt appears to have been made to turn this diversity to benefit by maintaining accurate records of the districts and dates of issue of the different printings. At the same time, Communist reproductions of the document have seemingly undergone only the most elementary analysis by the security forces, and documentation, as might therefore be expected, has played a very minor role in the spotting of infiltrators.
In the long-continued struggle against Communist infiltration and subversion, this counterintelligence function deserves much greater attention.
Analysis of documents is essentially a matter of comparison. But it is not simply comparing an item with an authentic example in order to detect discrepancies. Take two examples of a given signature: they will not be identical unless one or both have been forged. So the process of analysis is one of double comparison. First the two signatures are compared and points of similarity and difference noted. Then these differences are compared at least mentally with standards of acceptable variation which the handwriting expert has established through previous examination of large numbers of handwriting specimens and through study of principles based on similar experience by others. The most laborious part of the job, the establishment of norms, has therefore been accomplished before the two signatures have ever been seen. And norms could not have been established without large numbers of handwriting specimens available.
Essentially the same process is applied in all stages of document analysis, and invariably one of the greatest difficulties is to build up a volume of material extensive enough to determine norms. Standards of judgment are needed on all the innumerable details relating to format, alterations, aging, and applicability and use of the document under varying conditions.
One of the first things to be established is whether a document's format is the normal one, as determined from originals, photos, regulations covering issuance and use, and information reports of many types. All characteristics of the document must be considered--printing, dry seals, cachets, serial numbers, signatures and handwriting, style of entries, terminology, photos, inks, paper, binding, etc. Some of these elements must be subjected also to technical analysis, a specialized field requiring separate treatment.7
Interestingly enough, format analysis can be applied very successfully to Soviet agent documents issued by the Russians themselves. It is sometimes assumed that when an intelligence service requires the documents of its own country for its operations, it will make use of the genuine article, documentation invulnerable to counterintelligence analysis. This is by no means true. Even if an agent document is issued by the normal issuing office, it will frequently show peculiarities arising from the operational needs of the case. Most notably there is the problem of the date of issue: the agent cannot be equipped with birth certificate, school diploma, military registration document, occupational papers, and basic identity document all issued with a current date. But the blank documents appropriate to the required date may long since have been replaced by new forms, and the normal issuing official, not being a documentation specialist, will probably back-date the document as required without departing from current issuance procedures. The resultant discrepancies can be revealed by format analysis.
A Seaman's Passport carried several years ago by a Communist agent is a case in point. The document itself was genuine, duly issued by the appropriate Harbor Master, but it had been back-dated one year to meet operational requirements. Its serial number therefore corresponded to those of issuances a year later than the date shown, in other words to the actual rather than ostensible date of issue. It also bore a cachet which did not come into use until several months after its purported date and omitted the fingerprint which had been included up to and for approximately eight months after that date.
In addition, the document lacked the two dry seals normally placed over the photo. The logical explanation of this irregularity appears to be that it was received from the Harbor Master's office with serial number, issuance cachets, and signatures, but otherwise blank. The seal could not have been included with the issuance cachets since it had to be stamped on the still absent photo. For reasons of security or convenience, the intelligence officer did not see fit to have the completed document stamped later by the issuing authority.
These various flaws in format could be detected because of the availability of document intelligence reports and a large number of photocopied Seaman's Passports from which norms could be established. These made it possible to determine the approximate dates on which the new cachet was introduced and the use of fingerprints discontinued, and through the serial number sequence shown in the photocopies to pinpoint the exact date on which the questioned document was actually issued.
In addition to flaws in format, the Seaman's Passport contained certain biographic inconsistencies. It recorded a change of position from radio operator to apprentice, a retrogression violating the normal occupational pattern; and it indicated that the seaman had made no voyage for a full year after the document was issued. An even more damaging fact turned up in the photocopies of Seaman's Passports on hand: the bearer had held a second such Passport concurrently with the questioned document, apparently for a different mission.
The difficulty of establishing norms and distinguishing furtive violations of them is compounded, however, by human unpredictability, which can easily disrupt the best established official procedures. Irregularities do not per se prove fraud. A document held by a Hungarian refugee is a good example. It aroused immediate suspicion because the code number appearing in the dry seal impressed on the photo did not correspond to the number in the cachet of the issuing office. This irregularity, however, was the legitimate result of an unusual chain of events. Involved in a bicycle accident in Budapest, the bearer had had to present her basic identity document for police check. The Budapest police had observe that the dry seal was missing--something she herself had never noticed--and checked with the issuing office in another town. When the authenticity of the document was confirmed the woman was allowed as a matter of convenience to have the dry seal entered in Budapest, where she was then staying, although the Budapest office number on the dry seal would not correspond, as in principle it should, with the number in the issuance cachet.
In another refugee case, analysis disclosed entries in civilian documents inconsistent with the refugee's reported military record. Further interrogation of the subject satisfactorily explained these inconsistencies, drawing his exasperated comment that if there had been anything wrong with his documents, he wouldn't have presented them. This comment of a sensible man caught in the toils of a suspicious bureaucracy seems logical, but its logic is not shared by those who have something to conceal. The risk of having no proof seems greater to them than the risk of defective proof. They are generally not aware of the amount of information their documents will yield, and are prone to suppose that officials unfamiliar with them will fail to detect flaws.
One such hopeful deceiver was a Hungarian refugee whose documents were used to check his political background, especially with regard to whether he had served in the State Security Authority, the AVH. The man denied that he had, maintaining that he had been employed in the civil police only; but his documents told a different story. His Military Reserve Document recorded his police service in the space provided for military experience, and only service in the AVH, not in the civil police, is counted as military service. Furthermore, the Military Reserve Document was not issued until the termination of his police service, which therefore must have been considered the equivalent of military duty. This is one of the many cases in which documents that are themselves genuine serve on analysis to betray the bearer's falsifications.
Document analysis is a valuable tool in counterintelligence, but it is one tool only, to be used in combination with other investigative techniques. And since documents do not exist in a vacuum, intelligence data on many apparently unrelated subjects may enter into document evaluation. On one occasion, Navy reports on coastal Chinese weather corroborated the travel route shown on a Chinese Communist document, confirming other evidence of its authenticity.Furthermore, the dependence for analytic effectiveness on intelligence resources, document information and exemplars requiring constant collection effort, make this activity an integral part of intelligence processes, one that cannot be carried on in isolation from the whole.