ePassport issuance cranks up in U.S.
14 November, 2006
category: Biometrics, Government, Library
State Department rolls out citizen issuance though controversy still surrounds the project
By Marisa Torrieri, Contributing Editor
In spite of a summer of criticism that included a prominent researcher’s much-talked-about EU e-passport cloning demo, the U.S. State Department issued the first e-Passports and e-Passport readers.
Production began in late August at the Colorado Passport Agency and will expand to 17 other passport-issuing facilities throughout the United States in coming months.
And by the looks of things, most in the high-tech industry say it’s a case of so-far, so-good. Pilot testing concluded in April 2006 and the bulk of this year was spent preparing for issuance. In 2005, more than 10 million passports were issued in the U.S. so this preparation is no small task.
The new passport’s features include multi-layered security to authenticate passport holders and prevent unauthorized reading (called skimming) or eavesdropping:
- A 64 kbps contactless RFID chip in the rear cover of the passport
- Biometric data
- A metallic shielding material within passport’s cover
- A randomized unique identification (RUID) feature will mitigate the risk that an e-passport holder could be tracked.
As of late, “there’s really nothing new that’s come out as far as any security vulnerabilities in the passport or any changes that have been made to improve the passport,” says Randy Vanderhoof, chairman of the Smart Card Alliance. “Everything seems to be going pretty well.”
But others say the “feelings are mixed”
“Certainly some issues have been addressed, such as cover design and authentication between the passport and the reader,’ says Bob Blakley, principal analyst for The Burton Group, former chief scientist for security and privacy at IBM. Though these have been dealt with, “security vulnerabilities aren’t the only thing one should worry about.”
Another concern, for example, is that reading the new technology may decrease travel as new passports could take longer to verify resulting in longer lines and other disruptions.
Much media attention has been paid to the possibility of counterfeiting the passport through cloning. “Certainly some attention needs to be paid as to whether good copies can be made of the electronic passports,” Mr. Blakley says. “The new passport is significantly different than the old passport, and has not been extensively tested. I think it will be a while before we know if significant issues arise in terms of security of the passport. I think it’s likely we will discover there are additional issues that need to be addressed.”
Summer’s panic subsides as industry demonstrates security strengths
A media frenzy surrounded the summer demo at the Black Hat DEFCON security conference, when German researcher Lukas Grunwald demonstrated that the European Union e-Passport could be cloned.
Hundreds of Web postings followed the incident, ruffling the feathers of privacy advocates, who used it to fuel their belief that the data is more easily intercepted than people are led to believe. But the demo was largely dismissed by the technology community.
It’s true one of the most common hack attacks involves intercepting information that travels across the air via RF-enabled communication between chips and readers, but the data is protected by other security measures that make such scenarios unlikely, Mr. Vanderhoof says.
“This German researcher had taken a German passport, and with some technology he acquired over the Internet was able to make an electronic passport and show that he could copy it into another device,” explains Mr. Vanderhoof. “(But) what sounded like a vulnerability was not a vulnerability. Making a duplicate copy of the chip doesn’t give someone an opportunity to enter the country. The procedure at the border entry point involves reading the chip data and comparing it to the printed data that is inside the passport document along with the appearance of the individual who is standing in front of the border agent. Copying the chip does nothing because the copied data won’t match the printed data and photo of another passport or person holding it.”
If a chip was duplicated and inserted into another passport, the photo stored in the chip would not match the physical photo in the book. The person would be caught at the checkpoint. And because of the security measures used to store data in the chips, it makes it vastly more difficult to change data than to simply duplicate it.
This is precisely the point of the inclusion of the new technology into the passports. In the past, counterfeit passports had no electronic checks and balances so fraudsters would insert their photo into another person’s real document to cross borders. While most agree that no security effort is foolproof, the new e-passports are light years ahead of the prior iterations in regards to security.
Mr. Blakley adds, “there has been a lot of attention paid to the inclusion of the RFID chip, but it’s only one of a number of important changes – and all of those [variables] need to be looked at, not just the RFID chip.”
Issuance continues and suppliers emerge
While the old passports will still be valid until their expiration, all who are obtaining a passport for the first time, or renewing their passport will be issued the new e-passport.
Though a number of companies were in competition to produce the passport’s technological components, including the contactless chip, Gemalto and Infineon are providing some of the technical components, says a spokeswoman with the Bureau of Consular Affairs.
“It’s an ongoing process as well,” the Consular Affairs spokeswoman said. “We expect we’ll be working with multiple suppliers in the future.
For more on the Electronic Passport, including links to transcripts with federal officials, visit the Bureau of Consular Affairs’ Web site at http://travel.state.gov.
