 Hi there. So my talk today is not so super notes. How well does the US dollar note prevent counterfeiting? And introduce myself. My name is Matthew Duggan. I'm a member of technical staff at VMware and I've been a software engineer for almost ten years. I hold a bachelor's and master's degree in computer science. What interests me about security is I just, in working with systems, I like testing the limits of them and seeing how they react to adverse input. I'm also an amateur lock picker and beer brewer. So what this talk today is, is the security of US dollar notes. What the security is, how it's implemented, and how good a job it does at deterring counterfeiting. And so specifically what we're going to analyze is exactly what, um, how well it stands up against counterfeiting. And through information that I've read through publicly available sources, I'm not affiliated with the US Treasury nor have any affiliation with counterfeiters nor have attempted counterfeiting and nor intend to. So the reason why this is important is because despite the fact that a great deal of financial transactions are done electronically, the US dollar note is still widely used both nationally and internationally. And the value of the US dollar note or any other note for that matter is directly dependent upon its security, among other things. Counterfeiting attacks against currency at a low level lead to financial losses to the victim of the attack. But at a medium level can devalue the currency and at a large scale can actually constitute as an attack of economic warfare. And this has been done in the past and war is including World War II, the Civil War and the Revolutionary War. Now for this talk, I'm only going to be talking about US dollar notes. And as far as counterfeiting, I'm only going to talk about counterfeiting attacks in regards to the analysis of the features on US currency. So this will not be a how to, to happen with as far as counterfeiting. And I'm not going to be talking about coins or any other currencies. Now before I continue, I'm sure you all know, but I just like to say for the record, that counterfeiting is a very serious crime. And by counterfeiting I simply mean the creation of counterfeit notes. If you actually try and use a counterfeit note in a financial transaction, this is an even worse crime, which is known as passing a note. To give you an idea of the level of severity of it, it's actually defined directly in the Constitution alongside treason and piracy, not software piracy. And the, the Secret Service who investigates and arrests counterfeiters does so in a way that they try and maximize the conviction rate. And they boast a conviction rate of over 90%. And they also heavily emphasize investigations of amateur counterfeiters. So as far as the, the dollar design has been concerned, prior to the major redesign that was done in the 1996 series of bills, the US dollar note enjoyed a fairly long history with little change. The, that particular design was first issued in 1928. The reason why the design started changing and starting in the, starting with a major design in the 1996 series is due to the, due to research that was initiated by the US government about the emerging threat model of high quality scanning and inexpensive home color printing equipment, as well as the increasing incidents that were seen counterfeits. This was done in 1993 and additional studies were commissioned in 2006 and 2007. These studies were done by the national academies who assembled a panel of experts from the following institutions. What they found was is that the, the dollar note needed to be redesigned in order to better deter against counterfeiting threats. And this has led to two major redesigns, one being the 1996 series for denominations 5, 10, 20, 50 and 100. And the 2004, 2006 redesign of 5, 10, 20 and 50. And the unveiled but yet to be released 2009 redesign of the $100 bill. You have an idea, here's the $100 bill for the last 90 years. Anyone tell me it was on the 1922 bill? I heard someone say Benton, that's correct. So the US government that's in charge of designing the US dollars and also printing them is the Bureau of Engraving and Printing which is part of the US Treasury. I'm sorry, Department of the Treasury. They operate two printing plants, one in Washington D.C. and one in Fort Worth, Texas. The paper that's used for printing bills is made by a small family owned company in Dalton, Massachusetts known as Crane and Company. They are the sole supplier for secure paper for the US government and they also provide paper for passports and print currency for several small countries. Prior to the, prior to the 1996 major redesign and also the minor redesign of 1992, the original security bills are these three main features. First, the secure paper made by Crane and Company, it's a 75% cotton, 25% flax based paper, which makes it very durable and is created in a very painstaking process to give it a readily identifiable feel. Second is the Intaglio method of printing. Intaglio is where you take, you engrave an image onto a metal die and within the press, you fill ink into the recesses, wipe the top of it clean, and then press it into the paper at very high pressure. This gives the image that is printed a raised feel to it that is also readily identifiable. And lastly, are red and blue silk fibers that are distributed throughout the paper substrate to further, to further complicate the counterfeiting of bills. By the way, feel free to take out a bill and follow along with me in these features. So current security has added the following features to bills. First is the micro printing, which you can see from the first image, is a zoom in of the color of Benjamin Franklin, where they have United States of America is written in very fine print. This was added to thwart scanning and printing, which could not, for ones that were incapable of doing such a resolution. Second was the multicolor background, which was added to complicate the overall design of bills. Next is the watermark, which is visible in transmitted light, which is to say light transmitted through the bill, but not reflected light, which is light reflecting off the bill. This is a feature that can't be duplicated through scanning and printing. Also, there was the fairly high tech optically varying ink that was added to the bill. This is an ink that varies between one of two different colors that is generally was originally for the 1996 series was on denominations 20 and above. On later designs, it was on denominations 10 and above. This ink changes color depending upon the angle of incidence of light. So in holding up the bill, you'll be able to see a color change as you move it back and forth. This is accomplished by having microscopic particles that do this light changing effect suspended within the ink. Next is the security strip. This was added back in the minor 1992 redesign. This is a strip of polyester that's woven into the substrate of the bill, which is only visible in transmitted light. The security strip is has the denomination printed on it to defend against attacks where someone would try to change the denomination of an existing bill. It also glows a specific color by denomination under a black light, which also aids in defense against this kind of attack and is placed in a different position by denomination. The last two features, the magnetic ink and the infrared ink, are invisible to the naked eye, but were added to aid in machine recognition of bills. So to analyze how good a job all these features do together, I looked at each feature to determine one of two things. First, could it be replicated? And this is within the scope of a small scale operation. So say small group of people with money probably ranging in anywhere from like hundreds to probably tens of thousands of dollars. And whether it could be replicated, which is to say creating the same feature using the same processes or imitated, creating a facsimile of the feature which was suitable to pass. So, and let me just also add that the feasibility of the replication and the effectiveness of the imitation are justified by research that I have done for millions of dollars of counterfeits that have since been successfully created and passed. So the paper is by far the most difficult and complicated feature of the bill. Like I said before, it is 75 percent cotton, 25 percent flat-space paper made by Crane and Company. Now any paper making operation is a very difficult undertaking. It's very expensive, very complicated, requires very large equipment in order to make and expertise. Secure paper making is an even more difficult process. To add in difficulty of this, that particular paper that's used for the dollar is the only secure paper of its kind and it's only made by Crane and Company. So expertise in making that is very limited. Crane and Company also manufactures their paper using a different process than any other secure paper company in the world. They use a fordrenier machine whereas the others use a cylinder mold machine to form the paper. So expertise in that and secure paper making is also very limited. Added on top of that, a expert within the secure printing industry was quoted as saying to recreate the secure paper making operation Crane and Company would cost on the order about a hundred million dollars. So this is infeasible for any small scale operation. So for imitation we have to be concerned with two major features, two major tests of the paper. First, the counterfeit pen and second is the feel of the paper. So the way the counterfeit pen works is that this draws a yellow on genuine currency and draws black on fake currency. It's very inexpensive, very easy to be used by any cashier. So this is obviously a test that would have to pass. Now the way in which it works is that the secure paper used for it is a starch free paper as opposed to most other papers that are made. Most other papers, other starch free papers such as newsprint that are also made without starch would also mark as genuine currency. So if we use something like that we could pass the counterfeit pen. So the question then remains, if we used a starch free paper as our base for printing, for a counterfeiter to print their bills, would the feel of it, the lack of the readily identifiable feel be recognizable by an average person? Turns out from millions of counterfeits they're not. Oh yeah, in addition, as far as replication, in not being able to replicate the paper, the other features such as the red and blue fibers in the watermark would also not be replicable because those are required to be made during the paper manufacturing process. So as it turns out, from millions of counterfeits that have been passed, newsprint is not identifiable as fake by an average person taking a bill in a financial transaction. It's also very cheap. I estimated this cost by looking at a roll of newsprint on Amazon and defining the area by the effective number of bills and then dividing the cost by that. So second, we have to come up with a solution for the Intalio printing. So Intalio is the de facto standard for secure printing in the entire world, which is because of the fact that the metal dies that are used to make the bills are extremely difficult to reproduce. The machines are extremely expensive and access to them is limited. And the feel of it that's put into the paper by the Intalio is infeasible to create using any non-Intalio process. So the Intalio, secure Intalio presses are only made by three companies in the world and they're only sold to countries and private printers, private secure printers that is, which is a very difficult club to get into. And it's also one that's very visible to the secure printing industry who greatly frowns upon counterfeiting. So the, and the cost of one of these presses, if you had access to them, it's unknown because of the fact that secure, the secure industry generally uses non-disclosure agreements in the sale of any of their materials. And so the finding that is difficult. However, I did find an expert who said, who stated that the cost of a single secure press would be over fifty million dollars. So this would be infeasible for a small-scale operation. So if we wanted to imitate it, we would need to make sure that we had an image that was suitable for a person to be able to, that would look like the bill, which would include the precision of the micro printing as well as all the other subtle features of it. And it also might have to replicate the feel of Intalia. So if we use the low-cost, low tech approach, meaning we use a retail scanner and printer, we can easily replicate the precision of the images on the bills. So the question here is that, I mean, a secure, a professional money handler could definitely tell the lack of the feature of the Intalia type of printing. But the question is, could an average person do it? If the bill looked close enough to a genuine one? And turns out, they're not good at it. This cost is also very cheap and also gives us the ability to imitate the red and blue fibers, allows us to replicate the micro printing, I'm sorry, imitate the red and blue fibers, and also to imitate the multi-car background. Cost for this I found by taking the expected yield of Epson printer cartridges, taking the effective number of bills and dividing it by the cost of them. This also includes the red and blue fibers and the micro printing. Now the multicolor background is an imitation by the inkjet because of the fact that it's generally done by an offset printer. But counterfeits are shown that some counterfeits are made with a offset print press, some are not, and the ones that are not using inkjet, so it's suitable to pass. So that's also, so it's both infeasible because it's already expensive and the expertise is rather high and the fact that it is unnecessary. So next we get to the watermark which is a little more difficult. So the reason why, this is generally made by varying densities throughout the paper substrate. So during the paper making process when they form it, they have a three dimensional cutout on the wire mesh that the slurry is put upon, such that more would collect along the darker portions of the image, which is then pressed out to the same width. So unfortunately this is actually easily imitatable by a very low cost attack, where you simply print out an image of the watermark and you put it between two ply bills. Really all it takes is effort to do that. So that is, the imitation of that is certainly feasible and very cheap as well. So the OVI, like I'd say before, is very technically sophisticated. It was, this is an ink that was an adaptation of a technology that was created for the space shuttle. It is made by, like I said, it's suspending these microscopic particles within the ink to do the color changing effect. So, and this is made in a lab, it's very high tech, it's definitely infeasible for small scale operation. Unfortunately for us, unfortunately for the counterfeiters, the company that sells this ink to the Bureau of Engraving and Printing also makes color changing automotive paint. And they of course won't give you the same color combinations that are printed in any currency, but when analyzing whether or not it's the color changing effect or the colors themselves, the effect is sufficient. And this one's a little more expensive. The security strip, very simple. All we really have to do is we have a polyester sheet. We have to be able to print the denomination on it. Although we have to make it go in the dark, but you can get ultraviolet ink and in cartridge form. And just basically print that all out, you cut it out, you place it in the right place, and we're making two ply bills so inserting it in the bill is no problem. That's feasible and very cheap. And these eight features by themselves would give us a passable bill for any person that's receiving it since a person can't check the last two. But in analyzing those as well, the magnetic ink and infrared ink are also available in cartridge form. So if one were to take the time to figure out how to scan the image and be able to buy one of the machines which are fairly cheap in order to test, they'd be able to work out and ensure that they were, once they created and were able to tweak a solution for this, they'd be able to replicate it with high precision. So these are also both very feasible and not too much more expensive. So in the end, if we use this particular method of creating it, we can manufacture bills for less than $3 a bill after the initial cost of the setup and the expertise that we put into it. And really, there's nothing about this expertise that is limited to anyone of any training or anything like that. This is something that could probably be done within weeks or months by any determined attacker. So really what we can assess from this is that the efforts of the Secret Service are pretty good in keeping counterfeit dollar bills off the street since the dollar bill is the currency of choice to counterfeit. So two successful counterfeiters that I'd like to mention, Arthur Williams and Albert Tallton, who were independent of each other, they counterfeited modern currency, meaning the 1996 and the series and on, and they were independent of each other and they were both self-taught. And in addition to that, they also used the method of counterfeiting the bills, which was almost exactly the recipe that I just stated to you. Both of these guys were very successful and also convicted and were able to pass millions of dollars of counterfeit money. The interesting case with Albert Tallton is he was able to get all his supplies from staples. Lastly, I'd just like to touch upon the Supernote, which is what inspired this talk to begin with. The Supernote is different than the type of counterfeit that I described in this proposed attack in that it replicates all major features of the bills. So this includes the paper, the intaglio printing, the OVI, everything. And it does so with very high precision. Called the Supernote because in the opinions of some people, they say in some cases it looks better than the genuine bill. This was first discovered in 1989 by a professional money handler. The way in which they said they detected it was that the feel of the paper was a little off. And this is still around today. It's unknown who makes them. Although North Korea has been formally accused and then that accusation has been somewhat rescinded due to the fact that their diplomatic personnel keep getting caught trafficking large amounts of these. So the reason why it's doubted that they're making them is because secure industry experts have doubted that they would possess the technical sophistication to create the bills given the materials that they would need to create them. I'd love to tell you more about this bill, but unfortunately information is very limited and often conflicting. But if I can find, you know, a sufficient amount of stuff I'll certainly put together another talk on that. If you'd like to read more about the stuff, I recommend the following sources which I used to put together this presentation. First being the book Money Makers, which got here by Klaus Bender, who's a financial journalist. He put together this book which is a very good overview of the international secure printing industry. The next one, the art of making money is a very nice biography on one of those counterfeiters I mentioned, Art Williams, who was caught, went out of jail, then was caught again. It's currently in jail. But it's a very interesting tale as to how he came about becoming a counterfeiter and how he taught himself. And lastly are three publications that were made by the National Academies. These were commissioned by the Bureau of Engraving and Printing to study the current state of counterfeiting, counterfeit deterrent features and the current state of US dollars as to how well they would hold up. It's a very interesting and thorough analysis if you have any interest of this. I mean all the ideas you might think of like using plastic substrates, holograms, or like any other ideas, they generally go over and analyze to give the pros and the cons. And it's also interesting to see why some things might make the design some might not. And that's it. And I think I've got a few minutes left. So are there any questions? Yes. So the question is, is whether or not it would still be illegal to make bills if you did so for artistic or otherwise purposes. The answer is a definite yes, which is why I thoroughly emphasized the thing in the beginning. One of the additional things I'd like to emphasize in that, in these publications made by the Bureau of Engraving and Printing, when they talk about the, they break down the types of counterfeiters they're looking for being from low level all the way up to state sponsored. And the one that they're most concerned about is the amateur. And even ones doing it just to see if they can do it because they see that as a very big threat of someone who's proved to himself that he can make the bill, then we'll think of doing it later in the future. And they're very, they're very specific in saying they want to find these people and ensure that they stop them before they catch them and stop them before they become low level because any distributed attack would be very difficult to to find and take down. So the question is, is whether or not to take a $1 bill and turn it into a $100 bill? Yes, this is a valid attack. There are features and it's one that the US dollar is vulnerable to as opposed to other currencies because all the bills are made the same size. That's one of the reasons in addition to assisting blind people and being able to tell their money in other countries they make bills different size to prevent such an attack. And features such as a security strip that have the denomination in addition to the watermark prevent these types of attacks. Do the same laws apply to making all I see to making counterfeit foreign currency and then exchanging that for American currency. That would most likely fall under the the jurisdiction of the country whose currency you're counterfeiting. And I'm guessing at a money changing station they probably actually would have the machine recognition and and or professional money handlers to direct we go against this. That's so I would imagine that would be a very difficult attack factor. So the question is that the modern designs would be difficult to replicate wouldn't it wouldn't attack or try and and replicate a previous design bill. Yes they could. The the issue with that is is obviously if any large number of counterfeits or any prevalence of counterfeits were to start occurring in those types of bills people would simply stop accepting them as has been shown to give an example of things that I can be done despite the fact there is legal currency. People can still decide not to accept it depending upon the security of the bill which is why I mentioned that as as it pertains to its value. To give you an example in Canada back around 2000 they had a large problem with counterfeits of their hundred dollar bill to a point that about 10% with a it was estimated by the Bank of Canada that when the number of counterfeits reached 300 per million by the way the American is estimated about five per million back in 2002 that about 10% of vendors stopped accepting hundred dollar bills. So that would certainly be a way to which that you would stop having those bills be effective. And I believe that's all the time I have.