"The automated query can be based on:
* Identity information included in the application or in travel documents, such as name, date of
birth, national ID number, and/or
* the fingerprint of an individual."
Sounds like they could send requests to that computer system just based on publicly available information on a person like name and date of birth, even if the person never applied for a visa or tried to enter the US.
Well, a national ID number isnt usually publicly available info, even if it can be obtained by the US government through illicit means.
But yeah, it does sound that way, but certainly not clear cut to me what the situation is. I.e. does the agreement involve clauses about what to do if this is abused? Do we have a way to detect if theyre using this on non-travellers? Etc.
I wrote a system for a medical lab decades ago and IIRC I did actually have to change some RRN's manually. It's been a while so I'm not 100% sure, but I do think the changes were due to switching gender.
With a population of 12M and life expectancy of 80 years (give or take), probably not, as that needs ~400 newborns a day to maintain, and the birth rate is probably well below that, like in most Western countries.
Back-of-the-napkin math supports that, but baby births aren’t uniformly distributed. Well, anyway, I’m sure they thought about it. Thanks for explaining how I got my Belgian ID number!
It's not clear how it is supposed to work in detail. But it sounds like it could be implemented in a way that makes illegitimate queries possible. It doesn't sound like they want to really ensure that you can catch those.
I played with Estonia’s e-residency and they use asymmetric cryptography for everything so the ID is public but does nothing without the corresponding private key.
