The Channel logo


By | John Leyden 11th August 2006 16:24

Industry group defends e-passports

Counter-attack follows cloning demo

A demonstration that the chips on upcoming electronic passports can be cloned does not add up to a threat to either border security or citizen privacy, according to an industry group backing the development of the technology. The Smart Card Alliance argues that e-passports planned for the US rely on multiple layers of security.

Lukas Grunwald, CTO of German security consultancy DN-Systems Enterprise Internet Solutions, demonstrated reading and copying the electronic information in his German e-passport at a security conference at the Black Hat conference in Vegas last week. Grunwald said the data held on RFID cards within e-passports can be copied simply, which he reckons undermines claims by governments that e-passports will help stamp out forgeries. He argues the e-passport design will make no contribution to added security and is, in his words, "totally brain damaged". Not so, says the Smart Card Alliance, whose members are heavily involved in developing the technology.

"Even if someone could copy the information on your e-passport chip, it doesn’t achieve anything, because all of the information is locked together in such a way that it can’t be changed. It’s no different than someone stealing your electronic passport and trying to use it. No one else can use it because your photo is on the chip and they’re not you," said Randy Vanderhoof, executive director of the Smart Card Alliance.

The Smart Card Alliance said the standards adopted by the global electronic passport program makes passports "virtually impossible" to counterfeit. Furthermore nobody other than the passport user will ever be able to use them. The Smart Card Alliance details the security measures incorporated into e-passports. The information on the printed page, including the bearer’s photograph, is stored on the chip and displayed on a screen at passport control. By comparing the digital information, the printed passport and the person, customs officers can confirm everything matches. Discrepancies can be spotted if someone is attempting to use someone else’s e-passport chip information, a possibility raised by Grunwald's chip demo.

Data on the chip is not encrypted (at least for now) but it is digitally signed by the issuing country’s passport authority. Any changes to this data would therefore be detected at passport control. Unlike paper passports, where a photo can potentially be replaced, the digital photo and other information on the e-passport chip cannot be changed.

Shielding controls mean that (at least in theory) a passport needs to be handed over and opened before any information stored on the chip is communicated. All information exchanged between the reader and the e-passport chip is encrypted. "Together these capabilities mean that no one could use a lost or stolen passport, or even a copy of one, to illegally enter the country. They also prevent anyone from spying on US e-passports when the passport cover is closed," the Smart Card Alliance argues.

The Alliance makes a good case but some experts, such as security guru Bruce Schneier, question whether these security measures will withstand the test of time, especially considering the longevity of passport use (typically 10 years). Our analysis of Grunwald's demonstration shows how easily it was performed, which does little to assuage concerns that e-passports are not as foolproof as their industry backers would have use believe. ®

alert Send corrections


Frank Jennings

What do you do? Use manual typwriters or live in a Scottish croft? Our man advises
A rusty petrol pump at an abandoned gas station. Pic by Silvia B. Jakiello via shutterstock

Trevor Pott

Among other things, Active Directory needs an overhaul
Baby looks taken aback/shocked/affronted. Photo by Shutterstock

Kat Hall

Plans for 2 million FTTP connections in next four years 'not enough'
Microsoft CEO Satya Nadella


Suit-and-tie-wearing man tries to meditate, take deep breaths in faux yoga pose. Photo by Shutterstock
Emotional intelligence, not tech skills, is the way to woo suits
League of gentlemen poster - Tubbs and Edward at the local shop. Copyright BBC
One reselling man tells his tale of woe