How so? The article is talking about a fictitious person that's listed by name only on a sanctions list despite the government knowing the person doesn't exist. There is no possibility of the real Sean Byrne presenting a government number that is a negative match against the list because the fake Sean Byrne has no known ID to match against. The essence of the entry is just "here's a name to avoid".
The real Sean Byrne can produce a government-issued passport number, but that's clearly not enough for Apple.
I think it's more of a problem of all these "hyperscale" platforms where the cost of not being zealous enough is long litigation and devastating fines, while the cost of losing a single customer (or a thousand) is basically nil. This leads to all kinds of opaque, customer-hostile outcomes like this, also if you trip some filters not related to sanctions / mistaken identities. There's a recurring theme of HN posts along the lines of "an automated process at Google cut my business off, HN plz help".
In this particular case, it would be harder to produce a fake signature from a non-existent person if the signatures in questions were digital and backed by a national identity number. The kind of that I'm submitting when signing documents at work.
Aside from the fact the entry in question was added to the list almost two decades ago, itβs naive to assume that people would only be put on these lists if they have a verified identity number. If that was a rule, the easier rule of requiring a birth date would already have helped. Because while not everyone has a national ID number, pretty much everyone has a birth date.
There are people whose birth date is not really known (babies left at doorsteps, people from war-torn countries with no official record who had no parents to tell them of their birth date...).
I do not know how are they handled, but they probably get assigned one plausible date and it probably depends on the country.
In a sense, a birth date can be just as much an assigned number as an ID is. An ID can also have a checksum in it, potentially even a cryptographic one that only government can sign.
The real Sean Byrne can produce a government-issued passport number, but that's clearly not enough for Apple.
I think it's more of a problem of all these "hyperscale" platforms where the cost of not being zealous enough is long litigation and devastating fines, while the cost of losing a single customer (or a thousand) is basically nil. This leads to all kinds of opaque, customer-hostile outcomes like this, also if you trip some filters not related to sanctions / mistaken identities. There's a recurring theme of HN posts along the lines of "an automated process at Google cut my business off, HN plz help".