BY ANDY WILLIAMS, CONTRIBUTING EDITOR

A focus on securing borders is leading countries to review their official government-issued documents. Simple paper documents—the passports of old—are simply no longer adequate in this modern, post 9-11 world. This is giving rise to the inclusion of advanced identification technologies, including biometrics, PKI, and contactless chips.

While countries have, for several years, been experimenting with national ID cards based around biometrics and contact or contactless technology, laws passed recently by the U.S. Congress will eventually make it mandatory for any foreigner entering the U.S. to have some form of biometric identifier.

VISIT

Getting a lot of attention lately has been the U.S. Visitor and Immigrant Status Indication Technology (VISIT) system, a $500 million program that will require foreign students, tourists, and business travelers to use at least two biometric identifiers—digital fingerprints, iris scans, digital photographs—when entering and leaving the country.

Part of the 2004 deadline has been accelerated to the end of this year. Tom Ridge, secretary of the new U.S. Department of Homeland Security (DHS), said that by Jan. 1, 2004, foreign visitors flying into America’s major airports or arriving at the largest seaports must have biometric identifiers attached to their visas. By Oct. 27, 2004, all newly issued visitor documents should include biometrics and, by Dec. 31, 2004, officials expect VISIT to be fully operational at the 50 largest land ports in the country. By the end of 2005 the system is scheduled to be implemented in the remaining land ports.

All of this has created a scramble by countries, and companies, to enable the necessary software and hardware to meet the U.S. requirements.

Philips, Inside Contactless, and Iris, for example, will be rolling out contactless visas/passports soon that meet U.S. standards and, more importantly, those issued by ICAO (International Civil Aviation Organization).

ICAO

ICAO, based in Montreal, calls its new standards “a global, harmonized blueprint for the integration of biometric identification information into passports and other machine readable travel documents (MRTDs).”

Facial recognition was chosen by ICAO as the No. 1 feature cards should include.

“In a comprehensive analysis of various available biometrics,” according to an ICAO report, “the face rated highest in terms of compatibility with key operational considerations, followed by fingers and eyes.”

Another consideration, says the same report, is that the face has long been used by border control authorities and airlines to confirm identity with a photo ID.

The organization also targeted contactless integrated circuit chips to store this information since bar codes don’t have the memory capacity and are more durable, easier to integrate into a current passport and faster to process than contact chip.

The ICAO blueprint—consisting of technical reports and specifications—will help the association’s 188 member states implement a worldwide, standardized system of ID confirmation, ICAO maintains. States will have the option of using one or two secondary biometrics to supplement facial recognition. More than 100 ICAO members have issued 700 million MRTDs.

“I encourage all member states to cooperate fully in the implementation of this global identification framework that can significantly enhance public confidence in air travel security, encourage people to fly in greater numbers, and expedite the flow of passengers through airports,” said Dr. Assad Kotaite, president of the Council of ICAO.

With standards just now rolling in, there is obviously a lot of work still to be done. The biometrics industry itself is relatively small but it’s not going to remain so. According to the International Biometric Group, biometric revenues are expected to quadruple in the next four years, from $928 million this year to $4 billion in 2007.

Vendors respond
to the opportunity

Here are what some companies are doing, not only to comply with the new ICAO and VISIT standards, but with an intent to meet the needs of other countries looking to develop standardized IDs.

With its Mifare technology, Philips is developing a 72K EEPROM interface that will meet ICAO requirements and is expected “to sample” in the third quarter, according to Joe Pilozzi, Philips’ business development manager for smart card and security integrated circuits.

Called the P5CT072, the chip will include an ISO7816, an ISO14443A, and USB 1.1 interface.

“In keeping with Philips security leadership, this product will be submitted for cc. EAL5+ certification (for hardware) with expected completion by the end of this year,” said Mr. Pilozzi.

“The availability of the P5CT072 with triple interface was geared specifically for government ID projects as the flagship device to launch the entire Smart MX family of secure microcontrollers,” he added.

This MX family, he explained, uses low power and a “secure hand shake architecture that makes it ideal for high speed contactless applications such as passports/travel documents. This architecture has already been validated in our Mifare ProX product which was the industry’s first product offering PKI (public key infrastructure) capability over the contactless interface.”

He adds it is being considered for several European passport projects.

Heading in a slightly different direction is Inside Contactless, which has partnered with two other companies to produce the IFI, or Intelligent Film for Identification. The result is a contactless card with the traditional antenna and chip, but without a physical connection between the two, relying instead on electromagnetic coupling, says Bernard Vian, the company’s smart card marketing manager.

Utilizing the combined expertise of FASVER, a manufacturer of security films for document protection, and IER, which specializes in the integration of radio frequency identification solutions, Mr. Vian describes the IFI as a “complete solution.”

According to recent information released by the company, IFI “secures documents and guarantees a very high-level of authentication. The document is secured through the combined integration of a secured film with an embedded serigraphed antenna, a radio frequency chip, and the use of radio frequency readers.”

The embedded chip will store all of the visible printed information as well as the biometric data, such as facial picture, fingerprint, and iris.

Through the electromagnetic coupling—IFI partners call it a “breakthrough”—electrical connections are avoided, “eventually guaranteeing the required life-time (sic) for official documents.”

Without a connecting copper wire, which could break, the resulting card would be more durable, withstanding bending and other rough treatment that results when the passport/visa is shoved in a person’s pocket.

With this card “you remove one of its weaknesses (of a contactless card),” said Mr. Vian.

“IFI can be integrated at any stage: During the manufacturing process, at the issuance, when the passport is personalized at the remittance of a visa, for instance,” according to the company’s press release.

As to meeting the deadlines outlined by VISIT, said Mr. Vian: “I doubt very much that the 2004 deadline will be the case; but 2005, we can reasonably meet those deadlines.”

Countries not standing by, either

Many countries are moving forward—or have already implemented—national ID programs, issuing smart cards that could just as easily double as passports since most of the cards have enough storage to house biometric data. Belgium and France are preparing to roll out electronic ID cards that they hope will be flexible enough to accommodate international passport requirements.

Belgium, at least a year ahead of France, has a Java-based smart card with a contact interface. Infineon Technologies AG will supply the smart card chip with 32K of memory.

France will begin testing its ID cards next year and will have it operational a year later. But, according to French officials, no decision has been made yet on the type of technology—contact or contactless.

But listening to Mary McMunn, chief of the facilitation section of ICAO, contactless should have the inside track. “(Contactless) chips have gotten smaller and thinner and now it really does look feasible to put one in a paper document,” she said. “And the chips are getting greater capacity and cheaper. From that standpoint, it’s looking rather optimistic we’ll be able to use that.”

Starting in the fall of 2004, Dutch passports are to be equipped with an electronic chip containing the passport holder’s biometric details. That coincides with the U.S. VISIT deadline.

Myanmar (formerly Burma) was the second Southeast Asian country after Malaysia to issue its citizens electronic passports. The country opted for the Image Retrieval Identification System (IRIS) produced by Iris Technologies Berhad, headquartered in Malaysia. Iris also supplies Malaysia’s electronic passports. The photograph on the passport must match the electronic data stored on the smart card. This system, according to Myanmar officials, also has the capability of using fingerprint biometric measurements.

At least four Middle Eastern states—United Arab Emirates, Saudi Arabia, Israel, and Oman—will be issuing government ID cards, some as early as the end of this year, that could include biometrics and be able to handle multi-applications, such as driver’s licenses, passports, ATM, and medical cards.

A partial listing of other countries with some form of a national ID program include:

• South Africa
  Compulsory, but includes welfare benefits;
• Japan
  Voluntary for accessing government services;
•  Estonia
  Compulsory, but can also double as a travel document;
•  Hong Kong
  Compulsory and includes driver’s license, a fingerprint, and passport information;
•  Italy
  Compulsory and includes identity, health, and tax data;
•  Macao
  Compulsory with fingerprint biometric.
•  Sweden
  Voluntary with digital certificates to access public and private online services;
• Finland
  Voluntary, used for online banking and as a travel document.

Meanwhile, back in the U.S.

In response to the ICAO recommendations, the U.S. State Department announced it was investigating the feasibility of embedding a contactless smart card chip into U.S. passports.

The State Department’s Richard McClevey says the U.S. will attempt to meet the Oct. 26, 2004 deadline imposed on its major trading partners to have machine-readable biometrics in their travel documents. But he says that will be difficult. “I would like to have more time to do this,” he said.

As for visitors coming into the U.S. after Dec. 31, 2003 biometric-enabled visas will be generated at major U.S. points of entry for those visitors from countries who don’t enjoy “visa waiver” status, according to DHS Undersecretary Asa Hutchinson. Visa waiver countries have until Oct. 24, 2004 to utilize biometrics.

“The DHS will, for the first time, oversee the visa issuance process,” he said at a conference announcing the launch of VISIT. “We’ll be responsible for maintaining its integrity, working through and with the consular offices of the U.S. State Department. As a result, we’ll be able to require proof of identification from foreign national visitors to the U.S. We’ll do so through a minimum of two biometric identifiers—initially fingerprints and photographs; later, as the technology is perfected, additional forms such as facial recognition or iris scans may be used as well.”

He added that the DHS was looking to private industry to help build this system.

“The business community knows all about biometrics and they’ve been working long and hard on solutions We realize that the best solutions will not come from (Washington) D.C. but from entrepreneurs. We cannot secure our borders without the initiative and expertise of the private sector.”

In other words, he said, the DHS will be issuing by Nov. 30 an RFP for a prime integrator to help build VISIT. The contract will be awarded by May 2004. Qualifications for a prime integrator include border management experience, integration projects, and success with high-volume, performance-based applications, commented VISIT Director Jim Williams.