DEF CON 23 - Chris Rock - I Will Kill You
DEFCONConference
AI-assisted summary of DEF CON 23 - Chris Rock - I Will Kill You — original source. Check the original for full context.
Source published:
Key ideas
- Digitized vital records portals across multiple countries allow attackers to declare living people legally dead by exploiting automated, self-service onboarding for medical certifiers and funeral directors. (4:32)
- Because medical license numbers and mortician credentials are published online on public licensing boards, automated verification checks can be satisfied while routing portal accounts to attacker-controlled contact details. (4:32)
- Parallel vulnerabilities in Electronic Birth Registration (EBR) allow the fabrication of genuine, state-issued virtual identities complete with valid Social Security numbers, which can then be aged like shelf companies for financial fraud or liquidated via fraudulent life insurance claims. (25:06)
- Legal frameworks offer minimal recourse for reversing erroneous death declarations; statutory challenge windows can leave living victims legally deceased even when physically appearing before a judge. (19:15)
Detailed notes
## Background Published on YouTube by DEFCONConference on August 14, 2015, this presentation features security researcher Chris Rock detailing systemic vulnerabilities within global death and birth registration processes. According to the show notes, the talk demonstrates how anyone can anonymously obtain authentic death certificates to legally shut down a person's life, as well as create, age, and harvest synthetic 'Virtual' identities for financial fraud and life insurance payouts.
## TL;DR Security researcher Chris Rock breaks down the structural design flaws in centralized Electronic Death Registration Systems (EDRS) and Electronic Birth Registration (EBR) platforms across Australia, the United States, and other Western jurisdictions. By abusing public medical licensing directories and automated DIY portal registration, an attacker can effortlessly impersonate both a certifying physician and a licensed funeral director, bypassing the state's traditional dual-custody safeguards. Holding control over both roles enables bad actors to generate genuine state-issued death certificates to incapacitate rivals or claim probate estates. Furthermore, Rock demonstrates how fabricating birth records allows fraudsters to cultivate 'shelf baby' identities that can secure loans, execute asymmetric financial trades, and eventually be legally terminated for lucrative life insurance payouts.
## Atmosphere & style The presentation carries a sharp, irreverent, and darkly humorous tone, kicking off with tongue-in-cheek jokes about Rock's name and an unabashed embrace of total irresponsible disclosure. Rather than delving into esoteric software exploits, the delivery feels like a breezy, real-world con artist masterclass that systematically dissects bureaucratic absurdities—drawing both gasps and laughs from the packed DEF CON audience as Rock casually displays fabricated death certificates for DEF CON founder Jeff Moss and actor Hugh Jackman. The narrative blends technical insight with surreal judicial anomalies, leaving the audience with an entertaining yet genuinely unsettling realization of how fragile legal existence truly is.
## Bulletin - [04:32](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=272s) Digitized vital records portals across multiple countries allow attackers to declare living people legally dead by exploiting automated, self-service onboarding for medical certifiers and funeral directors. - [04:32](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=272s) Because medical license numbers and mortician credentials are published online on public licensing boards, automated verification checks can be satisfied while routing portal accounts to attacker-controlled contact details. - [25:06](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=1506s) Parallel vulnerabilities in Electronic Birth Registration (EBR) allow the fabrication of genuine, state-issued virtual identities complete with valid Social Security numbers, which can then be aged like shelf companies for financial fraud or liquidated via fraudulent life insurance claims. - [19:15](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=1155s) Legal frameworks offer minimal recourse for reversing erroneous death declarations; statutory challenge windows can leave living victims legally deceased even when physically appearing before a judge.
## Key takeaways - [00:00](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=0s) The vulnerability stems not from technical exploits, but from fundamentally flawed identity verification during the administrative digitization of vital records. - [03:13](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=193s) Legally declaring someone dead requires compromising only two roles in the registry pipeline: the medical certifier and the handling funeral director. - [04:32](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=272s) Public physician databases undermine Electronic Death Registration Systems (EDRS) by exposing the exact license details used by state portals as authentication factors. - [08:52](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=532s) Attackers can bypass medical cause-of-death scrutiny by utilizing publicly available CDC training manuals detailing official terminology. - [08:52](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=532s) Avoiding coroner referrals requires crafting filings that appear natural, avoiding deaths in hospitals, prisons, violent incidents, or suspicious pediatric patterns. - [10:56](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=656s) Registering as a funeral director on vital records portals faces minimal regulatory friction, with some jurisdictions requiring no professional licensing or physical facility inspections. - [14:30](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=870s) Authentic death certificates are routinely mailed to whatever next-of-kin address is entered into the electronic portal during filing. - [16:16](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=976s) Possession of an authentic death certificate allows attackers to file online probate petitions, appoint themselves executors, and legally liquidate the victim's estate and bank accounts. - [17:36](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=1056s) Declaring a target legally dead disables their financial assets, cancels legal IDs and passports, and effectively neutralizes adversaries by forcing them into administrative recovery. - [19:15](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=1155s) The 2013 Donald Miller case demonstrates that statutory deadlines can prevent courts from overturning death declarations even when the individual physically testifies in court. - [25:06](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=1506s) Electronic Birth Registration systems mirror death registry vulnerabilities, enabling the creation of synthetic personas that hold authentic state-issued birth certificates and Social Security numbers. - [26:31](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=1591s) Synthetic identities can be aged over years as 'Virtuals'—analogous to shelf companies—to build credit profiles, obtain mortgages, and take out life insurance. - [27:29](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=1649s) Mature virtual identities can be used to execute opposing leveraged trades on financial markets, pocketing gains on one persona while shedding debt and bankruptcy on the other. - [29:35](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=1775s) Retrospective birth registration policies allow attackers to backdate home births by up to five years, instantly bypassing the maturation period needed for synthetic personas. - [29:35](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=1775s) The dual-custody safeguard historically enforced between independent physicians and funeral directors completely collapses when a single attacker assumes both accounts within the same portal.
## Detailed walkthrough ### [00:00](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=0s) Introduction and the "End of Life" Vulnerability
The talk opens with an introduction by the track host, who jokes about the massive cabinet sitting on stage beside him, quipping that he hopes the supercomputer is there for tomorrow's presentation rather than being a learning machine brought in to replace him next year. Introducing the speaker, the host notes the eye-catching presentation description on manipulating identities. Chris Rock takes the stage and immediately breaks the ice with the packed room: “I'm not the black comedian, but it will explain the big audience that we have.” He sets the agenda for what sounds like a grim topic: the death industry, followed by the birth industry, and finally showing how the vulnerabilities in both can be leveraged to generate real money out of completely virtual human beings.
Rock emphasizes from the outset that this is not an isolated problem confined to the United States or Australia. Although his original research targeted the Australian system, the underlying administrative failure exists globally. He characterizes this systemic flaw in raw terms: “It's not so much a vulnerability it's just a fuck up, and it's a global fuck up.” Armed with this process knowledge, an attacker can officially kill another person, wipe out multiple individuals, or even legally kill themselves off on paper. Embracing the provocative nature of the research, Rock makes no apologies for skipping coordinated vulnerability reporting, declaring: “This is a definition of irresponsible disclosure.”
His interest in the mechanics of official death was sparked by a bizarre news story from his home state of Victoria, Australia. A hospital in Melbourne mistakenly issued 200 formal death notices to living patients instead of discharging them. The incident revealed to him how digitized and centralized the process had become—allowing two hundred living people to be officially terminated in one stroke simply with the click of a mouse.
- Research originated from a Melbourne hospital error that issued 200 death notices instead of discharge summaries. - The workflow weakness spans global jurisdictions, functioning equivalently across Australia, the United States, and other Western registries. - No remediation was sought prior to presentation, intentionally treated as full irresponsible disclosure.
---
[03:13](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=193s) The Global Death Registration Architecture
To explain where the systemic attack surface lies, Rock outlines the standard legal pipeline required to declare a human being legally deceased. In the United States, the process begins when an individual dies, prompting a medical practitioner to fill out a certificate of death within 24 hours. This initial document captures the cause of death, identity details of the deceased, and information about the next of kin. The document is then handed off to a licensed funeral director, who legally has seven days to dispose of the body and record burial or cremation details. While Australia handles these stages across two separate forms, the United States condenses both responsibilities onto different sections of a single certificate.
Once both the medical practitioner and the funeral director have signed off on their respective sections, the finalized paperwork is submitted to the government registrar—the Department of Births, Deaths, and Marriages. Upon validation, the registrar officially generates and issues a death certificate to the deceased's next of kin. From a security penetration perspective, Rock points out that compromising the entire infrastructure requires subverting only two sequential touchpoints: step two (the certifying doctor) and step three (the funeral director).
```mermaid flowchart TD accTitle: The Legal Death Registration Workflow accDescr: Three-step process showing doctor certification, funeral director body disposal, and registrar certificate issuance.
subgraph Phase1["Step 1: Medical Verification"] A["Individual Dies"] --> B["Doctor / Medical Practitioner<br/>(Fills Cause of Death within 24 Hours)"] end
subgraph Phase2["Step 2: Disposition"] B --> C["Funeral Director<br/>(Disposes of Body within 7 Days)"] end
subgraph Phase3["Step 3: State Issuance"] C --> D["Registrar / Births, Deaths & Marriages"] D --> E["Official Death Certificate<br/>Issued to Next of Kin"] end ```
- **Doctor’s window:** Medical professionals typically have 24 hours to fill out the cause of death and submit their portion. - **Funeral director's window:** Funeral directors have seven days to handle the physical disposition (burial or cremation) and finalize records. - **Attack surface:** Gaining control over doctor credentials and funeral director credentials allows full synthesis of an authentic death certificate.
---
[04:32](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=272s) Electronic Death Registration Systems (EDRS) and Rogue Onboarding
The core vulnerability stems from the transition away from physical signatures on paper forms toward web-based platforms. In Australia, doctors access an online portal where they enter their name, license number, and jurisdiction to gain entry. In the United States, a comparable framework called the Electronic Death Registration System (EDRS) was initiated in 2005 and has expanded across nearly all states. Beyond digitizing mortuary paperwork, governments rely on EDRS as a real-time mass mortality surveillance engine. Rock demonstrates this with data from Hurricane Sandy in 2011, showing how immediate cause-of-death reporting allows agencies to monitor localized drownings and efficiently plan public health resources, ranging from cancer initiatives to mandatory bicycle helmet campaigns.
```mermaid flowchart LR accTitle: Rogue Doctor Onboarding Exploit Path accDescr: Flowchart illustrating how public medical directories enable fraudulent doctor account creation in EDRS.
A["Public Medical Boards /<br/>'Google Doctor Database'"] -->|"Harvest Name, Office,<br/>& License Number"| B["State EDRS Self-Registration"] B -->|"Inject Attacker's<br/>Email & Phone Number"| C["Automated Database Validation"] C -->|"License Matches Record"| D["Attacker Provisioned as<br/>Verified Medical Practitioner"] ```
However, the rush toward digital convenience created an enormous identity verification gap. While early onboarding relied on paper enrollment forms submitted to state departments, many states adopted self-service "DIY" web registration portals. During DIY account creation, the portal asks for basic credentials: first name, last name, medical license number, and issuing state. Rock highlights the fatal flaw: the automated system verifies that the doctor's name and license number match state medical boards, but allows the user to freely provide their own arbitrary username, password, phone number, and email address.
Pointing out how easy it is to exploit this gap, Rock remarks: “So if you want to go find a doctor use Google Doctor database, and you will find one for every country and that'll give you all the license details and office details.” Because public-facing medical registers exist worldwide to let patients verify their physicians, any malicious actor can scrape valid medical license numbers and office details, plug them into the state's DIY EDRS portal alongside an attacker-controlled inbox, and walk away with an authenticated doctor account.
- EDRS was originally introduced to replace slow paper processing and power real-time mortality analytics. - DIY registration scripts validate license numbers against licensing boards without verifying that the applicant actually owns the contact details provided. - Publicly accessible doctor registries supply all identity data required to satisfy the state verification checks.
---
[08:52](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=532s) Faking Cause of Death and Dodging the Coroner
Once access to an EDRS portal is secured, an attacker faces the challenge of accurately filling out the medical cause-of-death section without a medical background. Official certificates require an itemized sequence from immediate cause down to underlying condition (lines A through D). Rock walks through an actual certificate containing medical terminology: an immediate death caused by pulmonary embolism (a blood clot in the lungs), resulting from left-thigh thrombosis (a blood clot in the leg), secondary to acute hepatic failure, stemming ultimately from liver cancer.
To bypass this apparent hurdle, Rock explains that attackers do not need a medical degree because government health authorities have done the work for them. The Centers for Disease Control and Prevention (CDC) publishes complete instructional handbooks online containing 44 step-by-step use case scenarios that teach doctors precisely how to phrase causes of death. Anyone can read the manual to master convincing "doctor speak" in minutes.
The most critical operational pitfall when fabricating a death certificate is avoiding an autopsy or coroner referral. Box 33 on standard US certificates asks: *Was an autopsy performed?* If an attacker marks a case incorrectly, the filing will automatically route to a coroner or forensic medical examiner. Rock clarifies the distinction: a medical examiner is a specialized physician trained in forensic pathology, whereas a coroner is often an elected crown-representative official who may have zero medical training.
To ensure the death certificate slips through administrative processing undetected, the fabricated filing must look completely natural and routine. Rock warns that the system automatically flags specific edge cases for investigation: - Any death occurring in a hospital environment. - Any death occurring within a correctional facility or prison. - Any unnatural or violent demise, such as a street homicide or gunshot wound. - Any suspicious pediatric pattern classified as a "reviewable death," such as multiple deceased children registered to a single parent. - Inconsistencies involving life insurance: declaring a non-smoker on an insurance policy who subsequently dies of lung cancer will trigger a payout refusal during claims review.
[10:56](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=656s) The Funeral Director Component and EDRS Access
Completing a death certificate through the Electronic Death Registration System (EDRS) requires two distinct authorizations: the medical certifier and the funeral director. After the physician submits the cause of death, the funeral director takes custody of the process to finalize the disposition details and complete the filing. In jurisdictions like Australia, this split is handled across two separate documents within the Death Registration System (DRS), whereas other regions integrate both portions into a unified electronic record.
```mermaid flowchart LR accTitle: Two-Stage Death Registration Process accDescr: Flowchart illustrating the doctor submitting medical cause of death followed by the funeral director submitting disposition details to the registrar. subgraph Doctor["Stage 1: Medical"] A["Doctor / Medical Certifier"] -->|"Enters Cause of Death"| B["EDRS / DRS Draft"] end subgraph Mortuary["Stage 2: Funeral Home"] B -->|"Transferred"| C["Funeral Director"] C -->|"Burial / Cremation Details"| D["Final Registration"] end D -->|"Issues"| E["Official Death Certificate"] ```
Gaining access to the system as a funeral director mirrors the medical registration loophole. An applicant navigates to the portal's self-registration page, selects the mortuary practitioner role, and enters a first name, last name, desired username, and a licensed funeral director number. Finding those credentials requires minimal effort, as state licensing boards publish searchable directories containing mortuary practitioner names, license numbers, and corresponding office addresses.
Once logged into EDRS, the practitioner has full administrative authority over the case. They can review medical determinations, assign or verify next-of-kin records, and generate burial or cremation permits directly through the portal, aided by online documentation provided by the state. Pointing out the simplicity of bypassing these checks, Chris Rock observes:
> “Now where are you going to get the details of a licensed funeral director? Again, they're online as well; just do a Google search on funeral directors in each state and it will give you details such as license numbers, office address, which is what you need to get EDRS registration access.”
- EDRS portals support self-service "DIY" user registration for mortuary practitioners. - State licensing lookup databases supply valid funeral director credentials, addresses, and license IDs. - Funeral directors can inspect doctor submissions, record next of kin, and apply for state burial permits.
---
[13:00](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=780s) Setting Up a Sham Funeral Business and Multi-Target Filings
Rather than relying purely on compromised credentials, establishing a legitimate, registered mortuary business proved remarkably trivial. Rock built a bare-bones funeral home website featuring stock imagery of caskets and floral arrangements alongside his company name. He submitted an official online application to become a registered funeral director in Australia, expecting substantial regulatory scrutiny. Instead, the application was approved entirely through automation three days later, without an interview, site inspection, or phone call.
Armed with an active funeral director account in the registry, Rock tested the limits of the software by mocking up a death filing for actor Hugh Jackman. The portal provides fields for the deceased’s particulars, parentage, and sibling relationships. Furthermore, the Australian interface includes bulk-handling capabilities, allowing a registered practitioner to submit multiple deaths simultaneously in batches.
> “Three days later I got an automated response that I was a funeral director—no phone calls, nothing.”
- Online funeral director applications can be processed and approved automatically without background checks. - Sham funeral service websites require little more than basic business names and stock images to pass visual muster. - The Australian DRS interface includes features permitting the batch registration of multiple deaths at once.
---
[14:30](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=870s) International Jurisdictions and Obtaining the Physical Certificate
Mortuary licensing standards vary significantly across jurisdictions, creating varying barriers to entry. In California, prospective morticians are required to hold an arts or mortuary science degree, and Nevada requires a $375 fee followed by a formal examination. Colorado, by contrast, had zero licensing mandates for practicing funeral directors, and the United Kingdom operates without formal licensing requirements. Establishing a physical mortuary footprint or procuring cemetery plots provides crucial cover if a death filing faces scrutiny:
> “The reason is if you want to commit insurance fraud, it's easier if there's a tombstone sticking out of the ground so you have that death insurance policy if there's an audit.”
When the medical certification and funeral components are completed online, the state registrar automatically generates an official death certificate and dispatches it by mail to the designated next of kin. Because the registrant supplies that address, the applicant can direct the document wherever they wish. Rock demonstrated this vulnerability by generating a bogus death certificate for DEF CON founder Jeff Moss:
> “Now I know it's not in good spirit to kill a host, but there's a death certificate of Jeff Moss; he doesn't know he's dead, he's walking around, but on paper he's dead.”
- Colorado and the United Kingdom enforce no statutory licensing requirements to operate as a funeral director. - Nevada charges $375 and mandates an exam, while California requires a specialized degree. - Physical burial plots and headstones serve as forensic camouflage against life insurance fraud audits. - Death certificates are mailed directly to whichever next-of-kin mailing address is entered into the system.
---
[16:16](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=976s) Exploiting Probate and Liquidating the Target's Estate
Holding an authentic, government-issued death certificate allows an attacker to proceed directly to the financial extraction phase. Rock drafted an online will naming himself as the beneficiary and estate executor, then leveraged the court system via a petition for probate. The petition acts as a formal submission notifying the court that the decedent has passed and requesting legal authority to manage their financial accounts and assets.
Once granted executor status, standard legal correspondence templates can be forwarded to financial institutions, instructing them to close the accounts and transfer the remaining balances. While a legitimate executor settles outstanding debts and distributes assets to heirs, a fraudulent actor can abscond with the funds. The ongoing modernization of the judicial system simplifies this process further:
> “You can now do a petition for probate online; the beauty of that is it's completely removed—you don't have to go to court.”
- Probate petitions filed with an authentic death certificate grant legal executor status over financial holdings. - Standard legal demand letters allow executors to instruct banks to liquidate and release account balances. - Online probate portals eliminate in-person court appearances, allowing estates to be claimed entirely remotely.
---
[17:36](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=1056s) Motivations: Financial Gain, Retaliation, and Paralysis
The motivations for digitally terminating an identity fall into three primary categories: financial profit, revenge, and tactical disruption. Financial schemes range from declaring oneself dead to collect life insurance payouts while living under an alias, to prematurely terminating aging relatives who control inheritances.
Interpersonal retaliation offers a silent vector of attack. Erasing someone's legal status automatically revokes driver's licenses, invalidates passports, and freezes bank accounts, leaving the victim trapped in an administrative void without their immediate knowledge. In adversarial legal or law enforcement proceedings, declaring an opposing attorney, judge, or investigator dead derails their capacity to operate. Rock emphasizes how shifting an adversary's focus instantly neutralizes their momentum:
> “If you're also committing this sort of a crime against somebody, they're more interested in protecting their own lives in terms of getting their financial history back on track than chasing you.”
- Self-death registration enables premature collection of life insurance settlements. - Digital assassination cuts off victims from bank accounts, credit cards, driver's licenses, and passports. - Targeted death filings against legal opponents or investigators force them to abandon active cases to repair their legal identity.
---
[19:15](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=1155s) The Irreversibility of Legal Death: The Donald Miller Precedent
The legal system contains severe structural flaws when attempting to undo a wrongful death designation. In 2013, an Ohio court heard the case of Donald Miller, an individual who abandoned his family in 1986 and was declared legally dead in 1994 to allow his family to collect benefits. When Miller reappeared decades later at age 61 to reinstate his Social Security number and legal status, the probate court ruled it lacked statutory authority to assist him. Under Ohio law, a death declaration could only be challenged within a strict three-year window following the ruling.
Despite Miller physically testifying in the room, the judge upheld the death finding, producing an unprecedented bureaucratic anomaly. Rock highlights the judicial absurdity of the decision:
> “The judge said, ‘Even though you're sitting in my courtroom in front of me, I can see you alive, there's nothing I can do: you're dead.’ So you've heard of someone being stateless—this one is bodyless.”
Following this case study, Rock introduced video documentation outlining his initial real-world registration test within the Australian registry, likening his trial run to Dexter Morgan learning to hone his methods. The footage was interspersed with news coverage highlighting systemic failures in hospital vital registries, such as a Melbourne hospital that accidentally dispatched death notices for over 200 living patients.
- Under Ohio law, a formal legal declaration of death cannot be overturned after a three-year statutory limit. - Donald Miller remained legally dead despite appearing in person before the probate judge. - Administrative errors within clinical registries regularly cause automated, erroneous death notices.
---
[25:06](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=1506s) Electronic Birth Registration (EBR) and Creating Virtual Identities
Creating a fraudulent human identity from scratch proves simpler than executing a digital death, as the birth process eliminates the need for a funeral director. The traditional birth registration workflow requires only three steps: the birth event, completion of medical documentation by an attending doctor or certified midwife, and the submission of parentage details. Once filed, the central registry issues a genuine state birth certificate.
```mermaid flowchart LR accTitle: Electronic Birth Registration Workflow accDescr: Three-step process for registering a new birth through physician attestation and parent entry leading to official birth certificate issuance. A["Baby Born"] --> B["Doctor / Midwife Form"] B --> C["Parent Details Form"] C --> D["Electronic Birth Registration (EBR)"] D --> E["Genuine Birth Certificate & SSN"] ```
Modern Electronic Birth Registration (EBR) systems operating across Australia, Canada, and the United States have moved the paperwork online. By leveraging public licensing databases, an attacker can register an account impersonating a doctor or midwife. Once authenticated, the user inputs delivery details directly into the EBR system, manufacturing a legitimate legal record without impersonating an existing citizen. Rock highlights why this bypasses standard fraud defenses:
> “This is not identity theft, we're actually creating a new ID; so why the government makes birth certificates stronger, that's actually better in our case—we're actually using a real birth certificate.”
- Electronic Birth Registration (EBR) systems only require certification from an attending doctor or midwife. - Access to EBR portals relies on the same public licensing databases used for death registries. - Fabricating a birth record generates an authentic, legally valid government identity rather than hijacking a victim's existing credentials.
---
[26:31](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=1591s) The Shelf Identity: Maturing "Virtuals" for Exploitation
The synthesis of unverified electronic birth and death registrations enables the creation and financial harvesting of synthetic individuals. In corporate law, a shell company holds assets without conducting commercial operations, whereas a shelf company is maintained over several years—filing annual taxes and generating documented history—to cultivate a spotless corporate credit profile designed to bypass automated compliance heuristics.
Rock adapted this methodology to human identities, creating synthetic individuals termed "Virtuals." By fabricating an initial birth registration, an operator acquires a verified Social Security number, qualifies for child tax credits, and can age the identity over years. The aged identity can build an independent credit history, open bank accounts, secure real estate mortgages, obtain life insurance, and eventually be processed through the death registration workflow to trigger insurance payouts:
> “So I thought, why can't I do the same with my baby? So I'll create a baby, good for a clean SSN, a Social Security number, tax benefits—or take it a little bit further: I call it the Virtual.”
- Shelf companies build creditworthiness by filing taxes and submitting annual returns over extended periods to bypass financial scrutiny. - "Virtuals" are manufactured identities built from valid birth registrations and clean Social Security numbers. - Aged virtual identities can be used to purchase property, launder money, establish credit, and secure life insurance policies prior to simulated death.
[27:29](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=1649s) Exploiting Virtual Identities: From Financial Arbitrage to the Ultimate "Do-Over"
Chris Rock explains the operational potential of mature virtual identities. Once established, these synthetic people can secure home loans, file and pay taxes, hold multiple life insurance policies, maintain active social media presences, and conduct stock trading. Rock poses the core question driving this research: why go through all the trouble of engineering a virtual person in the first place? The most direct financial angle is borrowing millions of dollars in loans and simply walking away without repaying them.
Beyond loans, Rock points out that virtual identities provide the ultimate clean slate: “The most important one, a do-over identification, so if you really fucked up, get a new ID, not a fake ID, a real ID.” Unlike forged identification documents that fail verification against official databases, a registered virtual identity holds genuine, state-issued credentials. Another lucrative avenue is taking out online life insurance policies on these entities; once an operator has extracted sufficient utility, they can kill off the virtual persona and claim the insurance payout.
Rock highlights an asymmetric trading strategy he researched using leveraged derivatives. In foreign exchange currency markets, a trader borrows substantial leverage to bet whether a pair like the US dollar or the euro will rise or fall. By using two separate virtual identities, an operator can place opposing leveraged bets: one identity goes long while the other goes short. One virtual identity becomes wealthy, while the losing identity absorbs catastrophic financial losses, declares bankruptcy, and can be shelved or abandoned without consequence. Rock also notes that high-risk activities, such as buying firearms or acquiring illicit drugs, should never be tied to an operator's real persona. Just as security practitioners adopt separate network infrastructure, proxy layers, and shell companies for operational security, synthetic personas act as the ultimate layer of personal anonymity.
```mermaid flowchart TD accTitle: Exploitation and Monetization of Virtual Identities accDescr: Diagram showing how a virtual identity is operationalized across financial arbitrage, clean slate identity creation, and life insurance fraud.
subgraph Operations ["Operational Uses"] ID["Genuine State-Issued Virtual Identity"] ID --> LOANS["Unsecured Home Loans & Debt"] ID --> HEDGE["Opposing Leveraged FX Bets"] ID --> DOOVER["Permanent 'Do-Over' ID"] end
subgraph Exploitation ["Monetization & Risk Shedding"] LOANS --> DEFAULT["Default on Debts (No Real Asset Seizure)"] HEDGE --> WINNER["Virtual ID A: Reaps Full Profits"] HEDGE --> LOSER["Virtual ID B: Declares Bankruptcy / Put on Shelf"] DOOVER --> OFFGRID["High-Risk Actions / Complete Identity Reset"] ID --> LIFEINS["Online Life Insurance Policy"] LIFEINS --> HARVEST["Fictitious Death Claim / Harvest Payout"] end ```
- **Leveraged Foreign Exchange Arbitrage**: Two virtual identities take inverse high-leverage bets on currency pairs; the winning persona keeps the profits, while the losing persona absorbs the bankruptcy. - **Permanent "Do-Over"**: Bypasses the vulnerabilities of forged identification by obtaining authentic, government-issued birth certificates and IDs. - **Physical Proxies**: Virtual personas can be deployed to purchase firearms or narcotics, keeping the operator's real identity entirely disconnected from law enforcement trails.
---
[28:54](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=1734s) Systemic Vulnerabilities: Portals, Licensing, and Public Registries
Rock breaks down the structural failures across public health and vital statistics registries that make this exploitation trivial. The entire foundation rests on poorly secured self-service portals. Electronic Death Registration Systems (EDRS) and their Electronic Birth Registration (EBR) counterparts allow external users to register through unauthenticated or loosely authenticated "do-it-yourself" web interfaces. Rock remarks on the absurd lack of controls, pointing out that in some jurisdictions, including parts of Australia, online registries do not even exist yet, while in the United States, self-registration portals lack verification.
A primary flaw is the exposure of medical credentials. Regulatory bodies require physician and midwife medical license numbers to be publicly accessible online so hospitals and employers can verify credentials before hiring staff. However, system designers mistakenly treat these publicly accessible license numbers as secret authentication factors rather than mere public identifiers. Once an attacker extracts a legitimate doctor's public license details, they can use them to register as a practitioner on vital records portals.
Compounding the problem is the mortuary sector. Around the world, funeral director regulations range from toothless oversight to no licensing requirements at all. By registering via automated DIY service portals, an attacker can effortlessly obtain credentials as both a certifying physician and a handling funeral director.
- **Publicly Scraped Identifiers**: Doctor and midwife license numbers are treated as authentication secrets within EDRS portals despite being freely searchable on public government databases. - **Lax Mortuary Oversight**: The virtual absence of rigorous licensing or identity verification for funeral directors allows bad actors to register mortuary accounts online without owning a physical funeral home or crematory. - **Parallels Across Systems**: Electronic Birth Registration (EBR) infrastructure is trailing behind EDRS chronologically, but is being deployed with the exact same architecture and security flaws.
---
[29:35](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=1775s) Why the System Is "Swiss Cheese": Consolidation and Retrospective Gaps
Rock explains the administrative pressures that turned birth and death registration systems into "Swiss cheese." Historically, physical paper records kept at local municipal registries were regularly lost to fires, floods, and natural disasters. Central governments pushed aggressively for centralized, electronic databases (EDRS and EBR) to avoid record destruction and eliminate errors caused by illegible doctor handwriting. However, this rush to digitize prioritized administrative convenience over integrity, removing physical gatekeepers without adding robust electronic verification.
Another critical policy loophole involves unregistered births. Governments struggle with population accounting because a notable fraction of babies go unregistered at birth. Rock points out that in his home region, roughly 2.5% of babies are not registered when born, often due to geographic isolation, severe socioeconomic disadvantage, or parental substance abuse. Public agencies discover these unregistered individuals only when a child reaches age five and must produce a birth certificate to enroll in school.
To account for this population, jurisdictions allow retrospective birth certificates to be issued years after an alleged birth. Rock reveals how fraudsters can manipulate this grace period: an attacker can claim a home birth took place up to five years prior, allowing them to instantly shave five years off the aging cycle required for a "shelf baby" identity.
Historically, the entire death verification model relied on the assumption of mutual collusion: “The government historically based the fact that you needed two parties in collusion, the doctor and the funeral director, to bury somebody to get rid of the body, but you can see here from the portal you can become both those persons.” By simultaneously assuming the online persona of the certifying doctor and the disposing funeral director, a single operator dismantles the dual-custody check completely. Rock concludes by cautioning that shifting from paper systems to internet-facing portals creates extreme systemic risk. He notes that he compiled a full year of independent research into an Amazon-published book covering how to raise, trade, bankrupt, and harvest virtual personas, before thanking the DEF CON audience to closing applause.
- **Centralization Vulnerabilities**: The desire to avoid paper loss from fire or flood led governments to create centralized registries accessible via web browsers, removing regional verification friction. - **The 2.5% Retrospective Loophole**: Because an estimated 2.5% of children are not registered at birth, authorities allow retrospective birth certifications at age five for school enrollment, giving fraudsters a shortcut to age their virtual personas five years instantly. - **Collapse of Dual-Control Safeguards**: The legal framework requires two separate entities—the medical professional certifying death and the funeral director certifying disposition—but a single attacker can easily establish accounts as both roles on the same portal.
## Notable quotes > [25:06](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=1506s) This is not identity theft, we're actually creating a new ID; so why the government makes birth certificates stronger, that's actually better in our case—we're actually using a real birth certificate. — Chris Rock
> [16:16](https://www.youtube.com/watch?v=9FdHq3WfJgs&t=976s) You can now do a petition for probate online; the beauty of that is it's completely removed—you don't have to go to court. — Chris Rock
## Mentioned Chris Rock, Kustodian, DEF CON, Electronic Death Registration System (EDRS), Electronic Birth Registration (EBR), Death Registration System (DRS), Centers for Disease Control and Prevention (CDC), Department of Births, Deaths, and Marriages, Donald Miller, Hugh Jackman, Jeff Moss, Amazon
## Video description Have you ever wanted to kill someone? Do you want to get rid of your partner, your boss or your arch nemesis? Perhaps you want to enjoy your life insurance payout whilst you’re still alive. Do you have rich elderly parents that just won’t die quick enough? Or do you want a “Do Over” new identity.
Then, this presentation is for you! I’ll provide you with the insight and techniques on how to “kill” someone and obtain a real death certificate and shutdown their lives. It focuses on the lack of security controls that allow any of us to virtually kill off anyone or any number of people. Forget the Dexter way of killing someone, I’ll show you how to avoid the messy clean up and focusing in on the digital aspects. You could be dead right now and not even know it.
The presentation will explain the death process and will highlight the vulnerabilities and its implications world-wide.
You will learn:
How to fill in a doctor’s medical cause of death certificate anonymously. How to become a funeral director and dispose of the body. How to obtain a Death Certificate. Once you’ve wrapped your mind around that concept, I will also show you how to “birth” Virtual identities that obtain real birth certificates. You will learn the birth registration process and the security vulnerabilities associated with this as well.
The third and final step of the presentation is “The baby harvest”, a concept that I’ve developed, which involves creating and raising virtual identities. This technique is similar to a shelf company. Virtuals will be “born”, registered with the government complete with birth certificates and social security numbers. They can open up bank accounts, get a virtual job to launder money, pay taxes, obtain home loans and obtain life insurance policies. They can be married to anyone (virtual or not) and be directors of companies…. the list is endless and to complete the circle of life, they can be killed off when they are ready for “harvest” for their life insurance payouts or sold as permanent I.D.’s. With no victim, this is taking identity theft to the next level.
Chris Rock has been active in the security industry for the last 20 years and is the founder and CEO of Kustodian, a specialized security company that specializes in Security Operations Centres, Penetration testing and independent research. Kustodian is an Australian, Middle East and Hong Kong registered company that has been operational for over 9 years. Chris has also spent 12 years in the banking sector and provides security services around the world for small, medium and large companies.
[Source](https://www.youtube.com/watch?v=9FdHq3WfJgs)