Over the last two years, the Identity and Passport Service (IPS) has
successfully implemented a range of new procedures and systems to
prevent identity and passport fraud. In March 2006, we launched one
of our most important counter-fraud initiatives, the biometric
passport.
Why has the UK introduced biometrics in its
passport?
The increasing threat of identity fraud
necessitates the strengthening of security features in passports.
The International Civil Aviation Organisation (ICAO – which sets
international standards) nominated facial recognition as the primary
biometric with iris and fingerprint as backup but not mandatory. The
use of biometric information to link a person to a passport can help
to counter identify fraud. In practice, biometric verification can
be used at border controls and to verify the image on a passport
renewal application against images held on record.
The use of biometric information to link a person to a passport
serves a dual role:
Helps to detect counterfeit or manipulated documents
Confirms the identify of the individual
What are biometrics?
Biometrics
are unique, measurable, physical characteristics which are used to
recognise the identity or verify the claimed identity of an
individual. Examples include facial image, fingerprints and iris
patterns
How does facial biometrics
work?
Facial recognition maps various features on the
face, for example, the distances between eyes, nose, mouth and ears.
The measurements are digitally coded and this can then be used for
comparison and verification purposes. Biometric technology is
perfectly safe as facial biometrics can be taken from a good quality
passport photo. You can download a pdf of IPS passport photo standards
here.
What information is stored on the
chip?
The
chip stores the passport holder’s photo and the personal details
printed on page 31 of the passport.
Can I see what is on the
chip?
The data held on the chip can only be viewed by
specialised readers. There are specialised readers (eReaders)
available at each of the 7 IPS regional offices. There is no
requirement to book an appointment and the service is provided free
of charge. Click here to
view details of the IPS regional offices.
Is the biometric passport
secure?
IPS
takes security and privacy very seriously. The new British biometric
ePassport meets international standards as set out by International
Civil Aviation Organisation (ICAO). We are confident that it is one
of the most secure passports available.
The new biometric passport has many new security features
including a chip. The new design will be harder to forge, the new
security features will show if the passport is genuine or that it
has been tampered with and the facial biometrics on the chip will
help link the passport holder to the document.
The data on the chip (your photo and personal information as
printed on page 31 of the passport) will be protected against
skimming and eavesdropping, through the use of advanced digital
encryption techniques. The chip will complement the security
features currently inherent in the passport, including the ‘machine
readable zone’ (found on the personal data page of the
passport).
How is the biometric passport
protected?
The British ePassport has been introduced to
internationally-agreed technical standards. The chip in the new
biometric ePassport is part of a suite of new security features to
help fight passport fraud and forgery. The data on the chip (your
photo and personal information as printed on page 31 of the
passport) is secure and cannot be amended. It is protected through
three layers of security:
A digital signature to show the encoded data is genuine and
which country has issued the passport.
A protection against unauthorised readings (“skimming”)
through Basic Access Control, a secure access protocol.
The data will be locked down using a Public Key Infrastructure
(PKI), which provides protection against encoded data being
changed. PKI is a digital encryption technology, which enables
validation of the data as being genuine and shows any change,
addition or deletion on the passport chip.
I have read in the media that other country
chips have been ‘cracked’.
The reported case where an
individual is said to have ‘cracked’ a Dutch passport is not
comparable to the security of passports in actual operational
conditions:
The system ‘cracked’ was a test system and did not fully
reflect the security standards present in passports that are
actually issued.
The researchers already possessed some of the key pieces of
security information which would not be readily available
otherwise.
It was an experiment conducted in laboratory conditions, not
in the field where immigration officers would have the opportunity
to notice the likely damage and/or alterations to the chip and the
passport booklet
I am concerned because the media have claimed
to crack the chip on the new British biometric
passport?
The media has simply outlined a procedure
which is the electronic equivalent of making a colour photocopy of
the personal details page (pg. 31) of the passport booklet.
Such an exercise is pointless. The information itself cannot be
altered; the photo would still be the same so the copy would be of
no use to an impersonator trying to use it fraudulently.
In any case, the forger must have access to the information in
the book, so there would be no need to clone the chip. If a forger
had access to your book it would be easier to photocopy page 31 than
to try to access the chip to get the same information.- the only
information stored on the ePassport chip is the basic information
you can see on the personal details page.
While it might be possible to copy the chip data, were an
individual able to gain access to the code required to open the
chip, it is not possible to modify or manipulate any of the data
because the advanced encryption techniques used are highly secure.
The Guardian article acknowledges the very high level of security
that prevents any modification of that data in order to prevent
forgery.
The chip is one part of the security features used in the
ePassport but being able to copy this does not mean that the
passport can be forged or imitated for illegal or unauthorised use.
British ePassports are designed in such a way as to make chip
substitution virtually impossible and the security features of the
passport render the forgery of the complete document impractical.
So, even if an individual decide to make a ‘cloned passport’ with a
cloned chip, all these measures mean that, the attempt would be
noticeable to an immigration officer examining it.
But isn't this worrying when looking ahead to
ID cards, which will hold so much information?
No.
Future passports and ID card chips will contain much the same data
as now plus additional biometrics, with an even higher level of
protection. Furthermore the information on the ID card will not be
all the information on the National Identity Register - the two
should not be confused; the card itself will only hold basic data.
Can the British passport chip be
cloned?
It is widely accepted in the industry that most
computer chips can be cloned, just like a passport could be
photocopied. The most important question is whether the ability to
clone a chip similar to that incorporated in the passport actually
poses a threat to the security of the passport.
The answer is that, while the ability to clone a chip may exist,
it would not be possible to successfully forge a passport by doing
this. The security around the UK passport chip prevents anyone
changing or deleting any of the data/information on the chip, which
is what is required to successfully forge the passport because:
As no data/information can be changed, modified, corrupted or
deleted, any clone would still contain the original holder’s
information.
The data on the chip is also locked using a digital
certificate and any change, addition or deletion is easily
evident.
The data on the chip is a copy of the data that is printed on
page 31 of the passport and any differences between the two would
be immediately noticed by officials.
At what distance can the chip be
read?
The IPS chips are designed to operate at a
distance of just a few centimetres from the reader. The new British
ePassport is protected with a key that can only be derived by
manually or optically reading the bio data page (the page with the
passport holders details on). In addition, once that key is derived
and communication established between the reader and the ePassport,
all messages are encrypted with a unique key for each and every
session thus thwarting would be eavesdroppers.
The Basic Access Control protocol requires the passport to be
open at the data page and the printed information optically scanned
before any data can be read from the chip. It is not possible to
read the UK passport when the passport is closed without the
relevant printed information.
Does the British ePassport use RFID chips
which can be read at long distances?
The chips being
used in passports communicate with the passport reader using radio
frequencies. However, use of the term "RFID chips" for these causes
confusion as, for many people, "RFID" implies functionality found in
"RFID Tags" which are low-security, passive devices, capable of
being read by standard equipment at a distance of several metres.
The chips used in passports are designed to be capable of being
read at distances of only a few centimetres and implement Basic
Access Control in accordance with international standards. This
requires the reader to scan optically information on the data page
of the passport and pass this to the chip before the chip will
communicate with the reader. Thus, it would not be possible for a
reader to extract any data from the chip at a distance or if the
reader had not been able to scan the passport's data page.
RFID tags will not be utilised in either the biometric passport
or the national identity card.
Can my passport chip be read from my pocket in
my coat on the tube?
No. In order to do this, an
individual would need a specialist reader that would require a code
that can only be obtained through information that is on the
passport page itself. Thus, it would not be possible without getting
physical access to the passport booklet itself and since the chip
only contains information that is printed on page 31 of the
passport, it would then be pointless to try to read the chip.
Do I need to exchange my current
passport?
Your current passport will remain valid until
its expiry date. You will not need to exchange your passport to a
biometric passport, but should apply for a new passport in good time
as and when your current passport expires. It is best to allow 3
weeks for a passport application.
What
is the US Visa Waiver Program (US VWP)?
The Visa Waiver
Program (VWP) enables nationals of certain countries to travel to
the United States for tourism or business for stays of 90 days or
less without obtaining a visa. Not all countries participate in the
VWP, and not all travellers from VWP countries are eligible to use
the program (although most British tourists will) so you must check
in advance. View more
information on US VWP
Do I need to change my current passport for a
biometric passport to travel to the US?
Most UK
citizens will not need to exchange their current digital passport
for a biometric book. Please note the following:
Children must have their own individual passports to be
eligible for entry to the US under the VWP
Your British passport will qualify for the US Visa Waiver
Programme (US VWP) if the personal information page (the page
containing your photo, your name and your date of birth) is on an
inside page of the passport rather than on the inside back cover.
If your personal information page is on the inside back cover
and was issued inside the UK, your passport will qualify for US
VWP.
IPS does not issue visas. If you are unsure about Visa
requirements you will need to contact the US Embassy in your country
of residence. Their contact details are available on their
website.
What are the additional new design features on
the biometric passport?
We have chosen birds as a theme
in the new passport to symbolise freedom to travel. The birds are
British residential and were chosen because they provided a good
scope for developing security features. In addition, the new British
biometric passport also includes the languages of the British Isles
clearly displayed on the inside front page. This is a new addition
to the passport design and includes English, Welsh and Scottish
Gaelic.
Over the last two years, the Identity and Passport Service (IPS) has
successfully implemented a range of new procedures and systems to
prevent identity and passport fraud. In March 2006, we launched one
of our most important counter-fraud initiatives, the biometric
passport.
The
chip stores the passport holder’s photo and the personal details
printed on page 31 of the passport.
IPS
takes security and privacy very seriously. The new British biometric
ePassport meets international standards as set out by International
Civil Aviation Organisation (ICAO). We are confident that it is one
of the most secure passports available.
What
is the US Visa Waiver Program (US VWP)?
Back to previous page
