A biometric passport has a microprocessor chip and antenna that contains biometric information to identify the holder. It is believed to prevent counterfeiting and make travel safer, but some argue it violates civil liberties. All 188 member countries, including the US, adopted the plan to roll out machine-readable passports with RFID chips in 2003. The chip contains an identification number and a digital signature, and cannot be changed. Despite protections, vulnerabilities have been demonstrated, leading to privacy activists arguing for contact cards instead. Many nations issue biometric passports, including Canada, Switzerland, and Singapore.
A biometric passport is a traditional paper passport embedded with a microprocessor chip and antenna that contains biometric information used to identify the holder. The microprocessor chip and antenna combination is usually a radio frequency identification (RFID) chip and uses radio waves to exchange information with a reader. The RFID chip in a biometric passport typically contains all of the information printed on the physical document as well as a digital facial image. This type of passport is believed to prevent counterfeiting and make it faster and safer for travelers to move from one country to another, but some argue that the use of RFID chips violates civil liberties.
The development and implementation of biometric passports began around 2003. In that year, the International Civil Aviation Organization adopted a plan to roll out machine-readable passports with RFID chips. All 188 member countries, including the United States, were bound by the plan. The first American biometric passport was issued in 2005.
It is difficult and expensive as of 2011 to forge the chip embedded in a biometric passport because public key infrastructure is the data authentication system in use. In addition to a digital facial image, RFID chips can also contain fingerprint and iris information. These images stored on the chip are compared with the characteristics of the person claiming to be the owner during the identification procedures at borders or at customs.
Due to forgery issues, all information contained in the RFID chip of a biometric passport is not public. Typically, the chip includes an identification number printed on its surface and a digital signature. These two numbers are stored in a database and associated with the passport holder’s personal information. The information stored in the RFID chip cannot be changed; if the holder’s details change, he will need a new passport and may have to pay a processing fee.
The chip in a biometric passport has some protections to discourage forgery. Some chips are assigned random chip identifiers to prevent traceability. Basic access control requires the reader to supply a key before being able to access the chip data, while passive authentication prevents the data from being changed. Chip cloning is discouraged with active authentication. If the chip includes fingerprint and iris data, then Extended Access Control (EAC) will be used for its strong encryption; EAC became mandatory in the European Union in June 2009.
Despite these protections, several vulnerabilities have been demonstrated in biometric passport chips. Marc Witteman revealed in 2005 that some passport document numbers are predictable, making it easier to guess the chip’s encryption key. EAC, Passive Authentication, and Active Authentication have also been the targets of successful attacks in Britain and other nations.
Some organizations claim that the chips can be read wirelessly at a distance by anyone with the proper equipment. Such vulnerabilities have led privacy activists to argue that contact cards should be issued in place of biometric passports. A contact card is read by swiping it through a reader such as a credit card, thus eliminating the possibility of anyone reading the chip information from afar. Other nations have adopted contactless smart card technology rather than the RFID chip.
A biometric passport issued in the European Union has digital imaging and fingerprint scanning information on the chip as of 2011, with some exceptions for individual member states. Many other nations now issue biometric passports, including Canada, Switzerland and Singapore. Nations lacking the necessary technological capacity and infrastructure will necessarily delay implementation.
Protect your devices with Threat Protection by NordVPN
