E-Passport System Test This Week

An anonymous reader writes "ZDNet has a story covering another Homeland Security test of the E-Passport system, a biometric program designed to stop counterfeit identification." From the article: "The passports contain biometric information such as a digital photo, as well as biographic information. The technology being tested promises to read and verify the electronic data when those carrying the e-passports attempt entry into the countries via participating airports. U.S. diplomats, Australian and New Zealand citizens and Singapore Airlines officials are among those who have been issued the e-passports. These people will also undergo normal screening procedures at the international airports."

Re:Dear Americans

[sharat_sc]

Well IBM had come up with privacy preserving authentication some time ago. MIT Tech review article [technologyreview.com]

Re:Great Idea - Already in use in certain areas

[daliman]

"I can't wait though for them to implement something such as an RFID tag inside of these"

In the New Zealand passports, they already have. At the same time, they doubled the cost and halved the duration of the passport to five years. There was no period for public comment, it was presented as a fait accomplit, as they were concerned that there would be a rush on the non-rfid, cheaper, long duration passports. Well, duh.

The NZ passport data is not encrypted in any way, although they claim the passports have some "physical shielding" to minimise eavesdropping. Except that, of course, the passport will be opened to be read; so the shielding is useless to prevent eavesdropping.

They claim that the RFID part is to be compliant with the ICAO guidelines, but the guidlines only require biometric data, not contactless chips.

Yeah, this stuff is just great. I'm sure that nobody would ever misuse legitimate access to this data, or gain illegitimate access to it either. Yeah, real sure.

Information on the actual ICAO guidlines is available here - http://www.icao.int/mrtd/download/technical.cfm [icao.int]

NZ Passports Lack Encryption

[daliman]

From the Ars Technica article on the same thing - http://arstechnica.com/news.ars/post/20060114-5982 .html [arstechnica.com]

"The Department will also implement Basic Access Control (BAC) to mitigate further any potential threat of skimming or eavesdropping. [...] BAC utilizes a form of Personal Identification Number (PIN) that must be physically read in order to unlock the data on the chip. In this case, the PIN will be derived from the printed characters from the second line of data on the Machine-Readable Zone that is visibly printed on the passport data page. The BAC also results in the communication between the chip and the reader being encrypted, providing further protection."

It's worth noting that the New Zealand passports do not have this implemented; all data is transferred in the clear.

What biometric?

[im_dan]

As an Australian citizen I just got one of these a month ago. I don't know what they are talking about biometric data being stored, I did not submit a thumbprint or undergo an Iris scan. It was just a regular passport application with only my name etc, so unless the government already has this information on file which I'm sure they don't. This e-passport is just a normal passport with my information on the chip.

Re:What biometric?

[TheDugong]

You are correct - if you read the documentation that comes with it (RTFM 8O) ), or at least did come with mine. Just mirrors your details incl photo. However, if you have dead chip or the chip contains incorrect data (which you cannot validate yourself) you are going to have to prove that you are not a forger and probably have your trip/holiday f&*ked.

Re:Problem is...

[BrokenHalo]

It doesn't even take any particular malice to fuck up the database. Three months ago, my wife applied for, and duly received her Australian passport. Last week, her sister attempted to do the same, and was foiled by the fact that some dyslexic moron had in that short interval managed to scramble the letters of her mother's maiden name on the database and consequently she was regarded as some sort of unperson.

Needless to say, it took a pile of statutory declarations and other depositions to sort the mess out. God knows what she would have done if she had had no existing relatives.

If these bozos can't even get the basics right, I don't see how they are going to make any impression on terrorism.

Re:Dear Americans

[Anonymous Coward]

In the US you do.

Even if in transit all passengers entering the US must first clear immigration, then pick up their baggage, clear customs before moving on to their transit flight.