For once, bureaucratic obstructionism pleases me. We all learned in September what can happen when the wrong people get the right credentials. Yet we live in a country that has no citizenship registry and awards citizenship to anyone whose mother happened to be here on the day she gave birth. The American birth certificate proves American citizenship; it is the only proof most of us have. As such, it is a credential with the power to “breed” an American identity—up to and including an American passport.

Lucky for our national security, then, that the records clerks of New York would never issue a genuine, forgery-proof, certified copy of my birth certificate to just anybody. No, just anybody has to go to California for some of those.

I flew out to Los Angeles not long ago, and drove north to the government center of Ventura County, a concrete campus set in a big parking lot. In the recorder’s office, members of the public were studying computer screens and microfiche readers. Behind the counter, a clerk rose to help me, an American flag glittering on her lapel. I said I wanted to buy a few birth certificates—no particular ones, for no particular reason. “It doesn’t matter who you are,” she said. “We don’t ask people why they come in. If you have the name, we’ll look it up.”

I didn’t have a name handy, so she brought out the microfiche index. Five plastic sleeves contained every birth recorded in Ventura County going back to 1873. I cruised the lists and lighted on three names: Dennis Alan Duck, Frank David Born and Joshua Ezra Ladin. I completed three order slips—leaving out birth dates, fathers’ names and mothers’ maiden names—and handed them to the clerk. In ten minutes, she appeared with the certificates. They had embossed seals, the heft and texture of bank notes and the complexity of Serabend carpets: steel-engraved intaglio borders with “Vital Record” printed in microline around their inner edges; pink-and-blue fields watermarked “Official Vital Record” and flecked with security thread. The order slips didn’t ask for my phone number or address. I signed them with a false name. The certificates cost $12 each. I paid cash, zipped them into my shoulder bag and walked out.

In public-records parlance, California is an “open” state. It not only lets anybody buy a certified copy of anybody’s birth certificate, but its law bars clerks from selling anything but certified copies. Maine, Massachusetts, Minnesota, Ohio, South Dakota, Vermont, Washington and Wisconsin also keep records open. Together, they have 2,375 offices that sell birth certificates for the asking. In Tennessee, Kentucky, and New Jersey, local offices won’t sell to just anyone, but central offices will. In Iowa and North Carolina, central offices won’t but local offices will.

Plenty of lowlifes know about this already. Now, well-tutored terrorists probably know, too—and some federal law-enforcers are getting nervous. Since September, the government has been setting traps for terrorists who hold visas. Visas are harder than ever to get and offer no protection against detention and deportation. Higher-ups in Washington may not have noticed, but terrorists intent on slipping through the dragnet don’t want visas anymore.

“With what happened on September 11, a lot of these folks in the terrorist world now are traveling around with false passports, birth certificates, drivers’ licenses,” George Hungate told me. He is head of watch operations for the Immigration and Naturalization Service at the inter-agency El Paso Intelligence Center. “In years past, it was illegal aliens looking for jobs. Then it went to criminals, then to fugitives, and here we are now with narcotics and terror.”

An Algerian named Ahmed Ressam set a chilling precedent in December 1999 by posing as a Canadian. Driving into the United States on his way to bomb the Los Angeles Airport, he presented a Montreal birth certificate to prove Canadian citizenship. Ressam didn’t make it to Los Angeles, but he did show that using a birth certificate to pose as someone else was a cinch up north. If would-be terrorists can pose as Canadians that way, why not simply pose as Americans?

Bradley Washburn is one American who knows how easily that can happen. An engineering technician, Washburn lives in Greensboro, N.C. In 1995, he got a call from an agent of the Diplomatic Security Service, an arm of the State Department that investigates passport fraud. On Dec. 14, 1995, a U.S. Passport Agency officer in Miami came across an application filed at a Tampa post office by a Bradley Edward Washburn who had produced a birth certificate showing he was born on August 3, 1954 in Greensboro, N.C. But the man made a small omission: He hadn’t supplied a Social Security number.

Suspicious, the officer handed the application to a security service agent who looked up Washburn in the Greensboro telephone book. There he was. On the phone, Washburn said he had never applied for a passport. The agent soon found that the applicant’s Tampa apartment was rented to a Robert Finks, born Nov. 23, 1953. He knocked on the door and arrested him. His fingerprints matched those in FBI records of one Robin Ray Fink, born June 13, 1955 and wanted in Maryland for bank fraud.

“It’s a weak document,” the real Bradley Washburn said when I called to ask about his abused birth certificate. “Anybody who knows what I know realizes how easily it can be obtained.”

Identity theft, an American growth crime, wasn’t the crime committed against Washburn. Identity thieves steal information to get credit cards, use them, and disappear fast. What befell Washburn—far less common, but in the context of terror no less troubling—is called “impostor fraud.” The crime isn’t hit-and-run; it’s hit-and-stay. The impostor’s aim is to become another person, allowing traces of a life best concealed to dry up and blow away. No impostor would leave electronic footprints with a credit card. His essential tool, of minor value to identity thieves, is the birth certificate—a document able to spawn credentials that, in circular fashion, can corroborate the holder’s identity.

“The birth certificate—that’s the one that starts everything,” a Diplomatic Security Service agent told me. “If you have that, that’s it. That’s all you need. You are that person.”

Start with a birth certificate and a utility bill addressed to the name on it; agencies often ask for bills as proof of local residence. With those, you can enroll in school for a student ID, or take a job and get a photo ID from an employer. Getting a CostCo card and a library card wouldn’t hurt. You can then use all your ID cards to verify that the birth certificate is yours. Along the way, you may be asked for a Social Security number. The government will issue a new or duplicate number to the name on the certificate. Failing that, you can make a number up. Social Security numbers aren’t identity codes. Even the police find them hard to trace.

“We’d have to go to a public source,” a U.S. law enforcement official said. “For us to get it out of the Social Security Administration is almost impossible without a subpoena—and that’s for a law-enforcement organization. If you’re in the driver’s license business, it’s next to impossible.”

Which is a reason why drivers’ licenses remain easy pickings for impostors—as they were for September’s terrorists. But impostors in possession of a certified birth certificate can go farther, and even parlay a driver’s license and a Social Security number into that most desirable of documents, the U.S. passport. The State Department issues seven million passports a year, yet its 4,500 clerks receive little schooling against fakery. Fraud taints up to 1 percent of applications, the department estimates: 70,000 a year. Agents investigate between 4,000 and 5,000, and only the frauds they uncover that lead to more serious crimes are ever prosecuted.

Since September 11, the service has dusted off thousands of unresolved cases, wondering if terrorists might be burrowing among them. At the root of every one, almost invariably, lies a dubious birth certificate. Dubious, not fake. Because 14,000 jurisdictions produce them with no national standard, forging birth certificates used to be easy. But as technology has made forgery harder, forgers have let production slide. Why bother to fake the real thing when the real thing itself grows on trees?

On the Mexican border, the INS is seizing 2,000 American birth certificates a month from people whose citizenship claims, its inspectors decide, are plainly false.

“Genuine U.S. birth certificates,” Ida Briones said on the phone from Texas. “They’re not counterfeits anymore.” Ms. Briones is an INS officer at the El Paso Intelligence Center. All but 10 percent of the fraud she tracks is now grounded on real documents. The State Department calculates a similar rate for birth certificates used in passport fraud. “We have vendors making $50 to $10,000 on every certificate they sell,” said Briones. George Hungate, her boss, said, “They’re valid, legitimately issued. What more powerful document can you have to substantiate your claim to be a United States citizen?” Briones added: “California’s an open state. You can get as many as you want. How do you like that?”

John William Dickey liked it fine—and, unlike Bradley Washburn’s impostor, chose his victim wisely. Born in Illinois in 1938, Dickey moved to California and began a career as a pedophile. On Jan. 11, 1985, he was released from state prison in Vacaville. Four days later, police in Mesa, Arizona, arrested him for burglary. Dickey gave his name as Daniel Ray Erickson, and showed a California birth certificate to prove it. It said Erickson was born in Riverside, California on Jan. 20, 1949. So he was. What the police didn’t know was that Erickson had died on Sept. 13, 1962, at age 12.

“Say you got the birth certificate of somebody who died in the first few years of life. They wouldn’t have a Social Security account or work history—no real paper record. There’s not going to be somebody else with a driver’s license and that date of birth. There won’t be any conflicts in the database world. For people who are serious and want the most bulletproof kind of phony identity and didn’t have the CIA to get it for them, this is the kind of thing that they would do.”

Back in action after serving time as Erickson on the burglary charge, Dickey used Erickson’s birth certificate in 1986 to obtain a California ID. He soon turned up in Florida, where he got Erickson a Social Security number. Secure in his identity, Dickey joined a parents-without-partners group and sexually assaulted a 10-year-old girl at a beach party. The Pompano Beach police arrested him on Sept. 26, 1986—as Erickson.

He did seven years. On Nov. 5, 1993, he walked into the Monroe County courthouse and applied for a passport in Erickson’s name. He would have gotten it, too, but for one goof: Earlier that day, he had gotten Erickson a Florida driver’s license. An officer at the Miami passport office noticed, took a closer look at Erickson’s Social Security number and saw that it had been issued when he was 44 years old. She called the Diplomatic Security Service. A fingerprint check came up with Dickey’s California arrest record. He did three more years for passport fraud—this time as John William Dickey.

If a principle of political philosophy justifies California’s selling a dead boy’s birth certificate to a pedophile, nobody seems to know what it is. Some blame the real-estate industry, the news media, and genealogical researchers, all of which need to explore public records. Speaking for the genealogists, Iris Carter Jones, who lives in Sacramento and lobbies for the California State Genealogical Alliance, said: “No closed record is a good record. That’s what you hear at many of our gatherings. Why close records and punish many people when only a small percentage misuse them?”

“No, no, that’s another issue,” Jones said. “For research you just get a copy of it. We don’t need certified copies. This really came to mind since September 11. I think California needs to do something, but I’m not going to be the one to suggest it.”

In the mid-1990s, Grace Napolitano did suggest it. As a member of the California State Assembly (she has since become a Democratic Congresswoman) Napolitano introduced a bill to bar sales of certified records to people with no reason to have them. “I obtained birth certificates of the people on my committee who voted against the bill,” says Napolitano. “They were flabbergasted.” But the bill died anyway. “California has a long history of openness about it,” Napolitano reflects. “That’s what’s so attractive about the state.”

California seems to have confused the good sense of keeping public records accessible to the public with the nonsense of distributing official versions of public records to the public at large. It and 13 other states persist in providing a delivery service for impostors the way homeowners keep hiding their keys under the doormat after the crime rate has shot up. But even the majority of states that have put limits on public access may have forgotten that the chief function of vital records is actuarial not evidential. Certified copies are inherently feeble as identification papers, but as long as they are dressed in fancy paper and elaborate seals, clever criminals and careless (or crooked) clerks will have a strong incentive to keep the masquerade alive.

Colorado, for instance, keeps all comers away from certified records, except for people named on the record, their siblings, and those who prove a “direct and tangible interest.” I once had a tangible interest in a woman born in Colorado Springs. A while ago, I sent away for her birth certificate, claiming to be her brother. In short order, I got a call from a Colorado vital-records supervisor who scolded me for breaking the law. I couldn’t be the woman’s brother, she pointed out; our parents had different last names. She then admitted that a clerk had mailed out my ex-wife’s certificate anyway. A few days later, it was mine.

Last November, a man applied for a passport in Philadelphia using a birth certificate issued by Hudson County, New Jersey. Reports didn’t say what gave him away, but after his arrest, the man turned out to have two names. Under one, he was a Pakistani with a drug arrest; under the other, a Jersey-born citizen. The citizen’s birth certificate wasn’t on file in Trenton, New Jersey’s open-record capital. It was on file, I was told, in closed-record Hudson County. Both names, moreover, were listed at a single address in Jersey City. How to explain this puzzling double identity?

“Money,” said the INS’s Ida Briones. “If the paper is genuine and had a serial number, one possibility is that a phony birth was registered.” The certificate may have been real, in other words, but the “citizen” had never really existed—he was only a “paper baby.”

Then there is the scarily simple case of Edward Jack Finney, born on Dec. 8, 1972 in New York. Finney died on July 22, 1999, but a year later, applied for a passport in Miami with a genuine New York birth certificate. An alert clerk found Finney in the Social Security Death Index, a databank listing every departed beneficiary. When the man showed up at the passport office again, he was collared. He turned out to be Deith Bridgeman, an immigrant from Grenada; a search of his belongings yielded two handguns and $18,000. At the moment, he is awaiting trial for two bank robberies in Queens. How did he come to possess a dead man’s genuine New York birth certificate? Bridgeman’s lawyer, Michael Hampden, told me: “It was given to him by the deceased person’s wife.”

The less useful fake documents become, the more appealing it is for criminals to borrow, steal, or generate real ones. Someone like Bridgeman might be surprised to learn that California sells birth certificates over the counter. Then again, a New York junkie eliminates the middleman—or middle state—by getting a copy of his own birth certificate and peddling it on the street. “Plenty of people out there,” said an investigator, “are willing to sell their identities.”

Impostors who make mistakes obviously do get caught. But many impostors surely don’t slip up; they slip through. Closing records will take government out of the trade, but at this point will not stop the business entirely. Those who understand this game say it’s the birth certificate itself that needs a new identity. The U.S. Department of Health and Human Services reported to Congress in September 2000 that its use as both a statistical public-health device and as the basic proof of citizenship has created “fundamental and irreconcilable conflicts.”

“The birth certificate is an unreliable identifier,” said an official who helped write the report. Its original purpose was merely to keep a head count for medical statisticians. “If you want it to be a source of identification, you destroy it from a public-health perspective. The congressional study was driven by the notion that improvements were possible, that the birth certificate could be a universal identifier. We were told to look for ways to strengthen it. But it dawned on us that maybe we have the whole wrong approach here. That, actually, there may be no way to fix this.”

In a country that doesn’t have or especially want an identity card, all forms of identification are imperfect by definition. As the ID debate goes on, that fact won’t go away: As Americans, we just don’t know who’s who. We can’t know if terrorists doze among us as pretend citizens-by-birth. We know of only one who knocked on our door: Ahmed Ressam, the millennium bomber arrested en route from Canada to Los Angeles. Quebec has since stopped accepting records like his as proof of citizenship. But the United States, which linked Ressam to Al Qaeda and sentenced him to prison for 130 years, has done nothing to puncture the American birth certificate’s dangerously inflated status. At the least, every jurisdiction should make it as tough to get any citizen’s certificate as New York City makes it to get mine. But with so many threats upon us, I guess the idea of a terrorist posing as an American must seem as remote as, say, the idea of a guy on an airplane trying to blow up his sneakers.