Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
United States Privacy

U.S. Biometric Passports By Late 2004 421

truthsearch writes "The Register is reporting 'Current plans call for the new passport books to include a contactless smart chip based on the 14443 standard, with a minimum of 32 Kbytes of EEPROM storage. The chip will contain a compressed full-face image for use as a biometric. European biometric passports, by contrast, are planned to feature both retinal and fingerprint recognition biometrics on their smart cards.' How they tie this to '9/11 fears' is curious considering the hijackers had valid paperwork."
This discussion has been archived. No new comments can be posted.

U.S. Biometric Passports By Late 2004

Comments Filter:
  • False Privacy (Score:5, Insightful)

    by Frothy Walrus ( 534163 ) on Tuesday July 22, 2003 @02:20PM (#6501871)
    Even though we have better-than-32K resolution in the
    Analog photos in our passports, I bet that at least half
    The Slashdot readership's back hair is standing on end.

    Maybe this is a privacy concern. Maybe. Especially if
    You're concerned about automatic face recognition and such.

    Anyone could create a device which could match your face from a
    Scan of your passport photo. And your retinas can even be
    Scanned while you're in line. What's the big deal here?
    • Re:False Privacy (Score:5, Informative)

      by eyegor ( 148503 ) * on Tuesday July 22, 2003 @02:29PM (#6501962)
      Although I agree with much of your post, retinal scanning from a distance is pretty far-fetched. Think about how a lens works for a second. In order to see a significant portion of the retina, you'd have to be very close.

      Iris scanning is possible from a bit farther away click here for info [aimglobal.org] and facial scanning from even further away.

    • False Security (Score:4, Interesting)

      by Anonymous Coward on Tuesday July 22, 2003 @02:33PM (#6502023)
      For me, the issue isn't that this invades privacy (although it's not unprecendented for governments to sell personal information from their databases when they run low on cash). The problem is that this is a whole lot of effort to go through to fix a security problem that doesn't exist. So you don't have 100% biometric proof that so-and-so is the REAL so-and-so. Guess what? Even with this biometric information, you're STILL not 100% sure, just a lot surer. And what exactly does this information get you, security-wise? Well, you know that Mr. Psycho Bomber is the REAL Mr. Psycho Bomber, and you happily let him pass because he couldn't be up to no good if he's not concealing his identity.

      Shit. We'd be more secure if we had a policy of only allowing women on planes, because there's actual statistical evidence to show they're less likely to cause problems. Sure it'd upset some people, but is it really better to implement a policy that doesn't even fix anything?
      • Re:False Security (Score:5, Insightful)

        by enjo13 ( 444114 ) on Tuesday July 22, 2003 @02:59PM (#6502314) Homepage
        What this fixes is the problem of HUMAN recognition of other humans.. which is remarkably bad. How many 16 year old kids borrow an older kids ID to sneak into a club or by liquor (hell I've done it). These are two different people, yet 90% of the time it works without a hitch.

        When your in customs, and you have thousands and thousands of people coming into the country.. the margin for error just goes up and up. Screw 9/11, this is just a good idea. It's nothing that we don't have already.. it's just a more efficient and more accurate system that better ensures the person who has the passport matches up with the person that passport was assigned to.

        • by lorcha ( 464930 ) on Tuesday July 22, 2003 @05:41PM (#6504731)
          The reason the buying alcohol with a fake trick works is that if you show reasonably-close ID, then the clerk is no longer at fault if you're underage. Consider the difference between these two situations:

          Officer: You just sold alcohol to a 16-year old. Did you card him?
          You: No
          Officer: You're in trouble, then.

          vs.

          Officer: You just sold alcohol to a 16-year old. Did you card him?
          You: Yes, and the picture looked like him.
          Officer: Well, it turns out it was his older brother. Try to be more careful next time.

          At that point, it's the 16-year-old's fault for posessing a fake id and using it to misrepresent himself. Both are crimes in the US.

          Also, it's in the store's best interest to sell to as many people as they can. After all, they're in the biz to make money. Not to enforce our puritanical drinking laws.
      • Re:False Security (Score:4, Interesting)

        by Alien Being ( 18488 ) on Tuesday July 22, 2003 @03:04PM (#6502356)
        You're so right.

        "Mr. Psycho Bomber"

        Or in the context of 9/11 (which is obviously the impetus for this change), "guy who can fell tall building with a single boxcutter". What high tech measures could have been used to prevent those attacks? Oh, I dunno...maybe CLOSING THE COCKPIT DOOR!

        I think the security experts need to learn the 80/20 rule.
    • Re:False Privacy (Score:5, Interesting)

      by CracktownHts ( 655507 ) on Tuesday July 22, 2003 @02:36PM (#6502052)
      Right on. My passport (US) has a digitized photo anyway, so I would assume my digital mug is floating around in a Federal computer system somewhere. Given that airlines generally (if not universally) maintain passport numbers in the passenger manifest of any flight in and out of this country, it's a trivial matter to have the pictures up and ready when the flight lands at its port of entry.

      The European scheme, with fingerprints and retinal scans, would disturb me a bit more if I were subject to it.

      • Re:False Privacy (Score:5, Insightful)

        by stuyman ( 46850 ) <laurenceb@NOsPAM.gmail.com> on Tuesday July 22, 2003 @02:49PM (#6502215)
        What sort of worries me about the use of fingerprints and such is that they provide information to the government that has uses outside of matching you to your identification. If they have your fingerprint stored in a computer, then they can just go fingerprint all the soda cans or whatever thrown out after that anti-IMF rally and produce a list of everyone who was there. The trick is to legislate against these things, and maybe if we really wanna be cool we could pass a constitutional amendment protecting privacy (the nebulous interpretation of one existing now is subject to change whenever the supreme court gets bored).

        We can use technology to protect our privacy, and we can use technology to eliminate it, so we'll have to keep ourselves safe and free with legislation instead. We outlaw murder, not knives...
        • whatever thrown out after that anti-IMF rally

          Please tell me where does it say that you have the right (not just privilege) to demonstrate anonymously?

          This question has stumped several activists already.

          • by Catbeller ( 118204 ) on Tuesday July 22, 2003 @04:32PM (#6503792) Homepage
            And please tell me where it says I don't have a right to demonstrate anonymously?

            The very concept of free speech revolves around anonymity. Pamphleting was upheld by the Supreme court to be a necessarily anonymous activity, for the pamphleteer could be subject to persecution (think Tom Paine).

            There won't be any protests if the protesters know that a mad administration is cataloging their names. And that's the whole idea of cataloging the protestors... isn't it? To get them off the streets, and shut them up.

            This administration already has come up with the idea of a "first amendment zone". You see, if the Appointed President is scheduled to show up in public, the Secret Service calls the local law. The local law will set up a pen, usuallly a mile or more away from the AP's speech location, in which all protestors are required to stay.

            Needless to say, Republicans are bussed in from the burbs if necessary to swell the AP's crowd numbers. And no protestors are in evidence.

            Back in the Pen, or First Amendment Zone, the cops and the Secret Service set up cameras on tripods and recording equipment galore, all pointedly pointing at the traitorous ones.

            Imagine if Clinton had penned up and cataloged the Monicaites. I can't imagine it, 'cause the local law and the SS would never have done it. But for a 'publican? No problemo!

            In such a situation, privacy is obviously being removed in order to intimidate any future protestors from ever trying to protest Bush ever again.

            After all, imagine what could be done with that info the SS are gathering. Employers could be called, a goodly majority of which are hard-right 'publicans. A large number of people in the U.S. have been fired already because they disagreed with Bush in public. That info is obviously going into an "enemies of conservatives" file somewhere, as well. Who has this info? WHY do they have it, and who the hell told them they could pen up people and catalog their identities?

            Where the hell are the reporters? No one seems to care.

            This is why the Ninth Amendment regarding unlisted rights not specifically enumerated exists: the right to privacy does indeed exist, altho not listed specifically. The government is not only bound by rights enumerated, but implied.

            If this does not seem to go over well with the radical right, then we do need to enumerate our rights with new laws. The pity is, those laws can be rescinded, whereas the Constitution cannot be, easily anyway.
          • by orthogonal ( 588627 ) on Tuesday July 22, 2003 @05:02PM (#6504231) Journal
            Please tell me where does it say that you have the right (not just privilege) to demonstrate anonymously?

            The United States Supreme Court said it in:
            • BUCKLEY, SECRETARY OF STATE OF COLORADO v. AMERICAN CONSTITUTIONAL LAW
              FOUNDATION, INC., et al. No. 97-930
            • McINTYRE, executor of ESTATE OF McINTYRE,
              DECEASED v. OHIO ELECTIONS COMMISSION No. 93-986
            • TALLEY v. CALIFORNIA, 362 U.S. 60


    • your retinas can be scanned while you're in line.... IN THE MOVIES.

      for a true retinal scan you need to get up close and personal with a machine.
    • Re:False Privacy (Score:3, Insightful)

      It's really a false sense of security on the government's part, since you can just get yourself one of these [webstrikesolutions.com] and dump the thing, take it apart and study it, then reflash it with Akmed's or Abdul's image/biometric information, and send him through customs as John Smith after doctoring the "paper" portions of the passport in the traditional methods. This is just one more easily circumvented "security measure". Those that have the time and resources will make a fortune selling "false biometric documentation"
    • The 9/11 attackers had real US passports, some attempted legally, others obtained via such out-of-band means as by murder, and bribery.

      So these lovely smartcard based passports will only provide better tracking of lawful citizens, while criminals and terrorists are still free to walk amongst us.
  • Money exists only to be spent. Technology exists mostly to be bought (and occasionally to just look cool on its own). Politicians are known for spending money like it's going out of style.

    Ergo, let's go burn billions on this new technology that wouldn't have made a damn bit of difference anyway. Cuz, like, it's cool.
  • Privacy... (Score:5, Funny)

    by __aaklbk2114 ( 220755 ) on Tuesday July 22, 2003 @02:24PM (#6501907)
    Excuse me, whoever posted this story forgot to add the following line somewhere in the summary:

    "The privacy implications here are worrying, and this sets a bad precedent, IMO."

    Slashdot editors, please make this correction immediatly.
  • *phew* (Score:5, Funny)

    by revmoo ( 652952 ) <slashdot&meep,ws> on Tuesday July 22, 2003 @02:24PM (#6501911) Homepage Journal
    Well, I don't know about you guys but I feel so much SAFER now!!

    Now our fears of terrorism are answered, I can now sleep well at night again.

    God bless America!
  • Worth? (Score:5, Interesting)

    by Squidgee ( 565373 ) on Tuesday July 22, 2003 @02:25PM (#6501921)
    What's this worth? The images on a smart-chip are going to be lower resolution tham your passport image, and I don't see what good being sure you are who you say you are is going to do..

    It doesn't effect privacy either; it's just kinda worthless, since "Adbar" could be a terrorist, but hey, we don't know that; we just know he's Adbar! 100%!

    • What's this worth? The images on a smart-chip are going to be lower resolution tham your passport image

      I just tried this with Photoshop; you can do a 120 DPI colour JPEG in less than 32kB without major loss of quality (that's 35mm x 45mm, roughly the same as the existing photo size). Better compression algorithms can no doubt improve on this. Yes, you'll never get film resolution but past 200 DPI, you'd be hard pressed to tell the difference.

      I have already used good quality inkjet prints of such an image (

    • Re:Worth? (Score:4, Insightful)

      by drix ( 4602 ) on Tuesday July 22, 2003 @03:01PM (#6502331) Homepage
      Your passport image has a hologram overlayed over it, which makes any attempt to scan or copy it functionally impossible--sure it can be done, but the resulting image is very obviously not original. I know of no hack around this.

      This digital copy, OTOH, will have no such protection. Oh sure, it will be encrypted and scrambled and blah blah blah, but anyone with half a brain and a propensity to scan the tech headlines of the past decade can tell you it's a matter of when, not if, it is defeated (e.g. CSS, Windows Media, "Enhanced CD" copy protection, half a dozen others).

      So, to sum up: the photo on your passport now: not hackable. The photo stored in your passport 5 years from now: hackable. You can see why some claim this will degrade our privacy.
      • Re:Worth? (Score:3, Insightful)

        by autopr0n ( 534291 )
        This digital copy, OTOH, will have no such protection. Oh sure, it will be encrypted and scrambled and blah blah blah, but anyone with half a brain and a propensity to scan the tech headlines of the past decade can tell you it's a matter of when, not if, it is defeated (e.g. CSS, Windows Media, "Enhanced CD" copy protection, half a dozen others).

        There's a difference between being able to hack something with access to the hardware and software needed to make it work (DeCSS,Copyprotected CDs) and those tha
    • Re:Worth? (Score:3, Informative)

      by swillden ( 191260 ) *

      The images on a smart-chip are going to be lower resolution tham your passport image

      Not so you'd notice. I work on a smart card-based secure ID system that uses JPEG2000 to compress photos to less than 2KB. With either a nice, plain background or using region-of-interest coding you can get a surprisingly good quality image in well under 2KB. 1KB is harder, and introduces more artifacts, but you can get images that are usable for authentication even in that tiny space.

      With 30KB or so, JPEG2000 and RO

  • by corebreech ( 469871 ) on Tuesday July 22, 2003 @02:25PM (#6501923) Journal
    They ratchet up security procedures, requiring everybody to show ID when flying, but when they decide that the aircraft went down not because of terrorism but because of a design flaw, do they roll back the tightened security?

    Not on your life.

    Face it lads, we're property. Nothing more.
  • Calm Down Ladies (Score:2, Interesting)

    by imaro ( 584142 )
    It's nothing to fear, infact, it is about time that this technology got implimented. It is a secure way of verifying a person's identity. It's not tracking software, so you can still move freely about the globe as long as you are supposed too.
    As for the 9-11 throwback, this technology wouldn't help so much, but it does have some excellent usages for preventing fake id's, as well as locating kidnapped or missing children.
    • I thnk its more likely that the industry of forging IDs will solve the unemployment problem.

      If it can be made, it can be faked.

      However, prople may be more willing to believe an electronic fake than an analogue one - so watch out for the new generation of mega-scams(TM)

    • "Supposed to"? (Score:2, Interesting)

      by gorzek ( 647352 )
      Who gets to decide who is "supposed to" move from point A to point B? The government? Come on. No one has any right to tell you what countries you can or cannot go to. Beware of anyone who suggests otherwise.
    • Re:Calm Down Ladies (Score:2, Interesting)

      by tomcio.s ( 455520 )
      It's not tracking software, so you can still move freely about the globe as long as you are supposed too. ...
      as well as locating kidnapped or missing children.
      Emphasis added.

      Now how is your first statement not a negation of the other one?
      You can have either or but not both. (Unless you consider the possiblity that all minors will be tracked whereas adults are not.)

      Either way, I can't see a good thing comming of this in terms of anonymity.
    • What happens when they link all their passport scanners both in the US and other countries to a central DB. What happens when they tie information on that chip in the passport back to the central DB "for validation reasons". What's to stop them logging where you are at the time? I think it would be naive to assume that the US government isn't actively seeking to link up their immigration computers with those of other countries. No doubt US will do it with Canada first, and then perhaps working on some o
    • by dunedan ( 529179 )
      It wouldn't have helped prevent 9-11 but I do think it would help prevent FEARS about future 9-11 events.


      Thats usually the governments game. Why else would they take your fingernail clippers?
  • by Gefiltefish11 ( 611646 ) on Tuesday July 22, 2003 @02:26PM (#6501927)

    Better to match on appearance than somethning more insidious and Ashcroftian (look mom, I made a new word!)...

    Please bleed in the cup, Mr. Anderson. We need to match your DNA to this passport.
  • Follow Suit (Score:3, Funny)

    by GenusP ( 645673 ) on Tuesday July 22, 2003 @02:27PM (#6501933)
    I think that life would be easier for everyone if the standards for passports were the same everywhere. Might as well follow suit with Europe and allow more info stored on the card. Here we are just setting ourselves up for upgrades within a short period of time. We could also switch to the metric system while we're at it.
  • challenge? (Score:5, Funny)

    by r_orourke ( 677552 ) <orourke AT ryanorourke DOT org> on Tuesday July 22, 2003 @02:28PM (#6501944) Homepage
    "With this approach "you can read a chip and confirm its validity, but you cannot create one." said Moss.

    What is that? A challenge?

    • Re:challenge? (Score:3, Interesting)

      by Mikey-San ( 582838 )
      Just like you couldn't mod an Xbox without a mod chip, right? Or break CSS? Or coordinate a massive attack on the two largest towers in the world and fly /two/ planes into them? These guys are idiots.

      Tell a geek he or she can't do something, and that something will get done.
    • Re:challenge? (Score:3, Informative)

      by swillden ( 191260 ) *

      What is that? A challenge?

      Sure. Let's call it the "RSA-2048" challenge.

      There's every reason to expect that these passports will be essentially unforgeable. Why? Unlike all of the other cases of broken security technology slashdotters like to point at, this is a case where the keys and devices that implement the security are not placed in the hands of the public. The signing keys will only need to exist at the passport issuance centers, and the devices that verify the keys will be under the control o

  • by Anonymous Coward on Tuesday July 22, 2003 @02:28PM (#6501947)
    Makes sense for Europe. We'd have to coin a new phrase for our system here in America. Something that denotes that it's base 12...
  • biometric passports following the l337 standard -
    EPROMs with biometrics that you wear in a necklace and access through your GBA

  • by stuyman ( 46850 ) <laurenceb@NOsPAM.gmail.com> on Tuesday July 22, 2003 @02:28PM (#6501951)
    This honestly doesn't seem like such a big deal to me. Consider that this changes very little: there's already a picture on your passport, and any country that wants could just photocopy or scan that. This probably won't help prevent terrorism, though it certainly seems to eliminate a less sophisticated avenue of fraud. Far fewer people have the technology to produce a fake passport with a smart chip than without.

    Here's another interesting potential positive. When you want a visa to visit a country (something we americans don't need to do for most "westernized" nations) you usually need to send along 2 passport-sized photos, which means the PITA of going to get pictures taken. Now, if the embassy of Brunei has a smartcard reader for the passport, they could just download the picture from your passport instead! Electronic storage of visas and such might even eventually let us do all these things over the net.

    There are privacy issues with any form of identification, but they rely less on what the identifier is but more on how it is used. If we want to preserve our rights, we need to fight against regulations forcing us to show or carry ID (a la Gilmore). The form these IDs take is not so important (well, unless they want to implant them in our skin, or make them checkable via radio, etc, but these are separate animals...)
    • by davebooth ( 101350 ) on Tuesday July 22, 2003 @02:51PM (#6502239)

      This honestly doesn't seem like such a big deal to me. Consider that this changes very little...
      ... seems to eliminate a less sophisticated avenue of fraud...

      This sort of matches my viewpoint too. I mean, as a Brit living in the USA I already have an ID card with multiple features to make it hard to fake and biometric data (photo and fingerprint) - its called a "green card" although only the lettering on the back is green anymore. Wouldnt surprise me in the slightest to discover that theres all sorts of data encoded on it in machine-readable form from my visa application through to the final interview when they authorised giving me the card in the first place. I havent looked into it in any detail because I dont give a rats ass. They have the data anyway and the rules that govern its use dont change just because they stick it on a card. The harder it is for some jerk with a semtex fetish to fake one of these and maybe pretend to be me the happier I'll be. Personally I'd rather not get a vacation in Cuba thanks to identity theft....

    • by antiMStroll ( 664213 ) on Tuesday July 22, 2003 @03:22PM (#6502644)
      Consider that this changes very little:..

      And further considering that your country has made hundreds of these little, and some not-so little, changes over the past twenty years (remember the War on Drugs and Patriot Act?) there's little worry that you'll ever lose basic rights and freedoms. After all, hundreds of these little steps never add up large steps, right?

  • Welcome.. (Score:5, Funny)

    by grub ( 11606 ) <slashdot@grub.net> on Tuesday July 22, 2003 @02:28PM (#6501952) Homepage Journal

    Welcome to the United State of America. Allow the nice lady at the counter to take your picture, retinal scan, fingerprints, blood sample, stool sample, urine sample, hair follicle, oral swab. After that please check one of the two YES or NO boxes next to "I AM A TERRORIST" statement.
    • Re:Welcome.. (Score:2, Informative)

      by Nexus Seven ( 112882 )
      When you fill in a Visa-waiver form to enter the US, "Are you a terrorist, or have you ever been involved in terrorist activities?" is one of the very questions on the sheet.
  • 9/11 ties (Score:3, Insightful)

    by nycsubway ( 79012 ) on Tuesday July 22, 2003 @02:28PM (#6501954) Homepage
    How would you not tie it to 9/11? When you want total control, you will do anything to achieve it. Even using a tragic event as a means to what you want.
  • by Dr. Bent ( 533421 ) <<ben> <at> <int.com>> on Tuesday July 22, 2003 @02:28PM (#6501957) Homepage
    Woah! This is going way too far....A picture in a Passport! The audacity! Won't anyone think of the 4th admendment? I should quit my job and join the Michigan Milita. Viva La Revolution!

    Come on people....If this had been done 5 years ago the response would have been "A digital picture in my passport? SWEET! One more thing I can try to hack..." Not everything is a facist government conspiracy to rob you of your freedom. Sometimes it's just using technology to make something better.
    • Try to hack?

      Surely you don't mean that. I quote my un-technological passport:

      Alteration of Mutilation of Passport
      This passport must not be altered or mutilated in any way. Alteration may make it INVALID, and, if willful, may subject you to prosecution (Title 18, U.S. Code, Section 1543). Only authorized officials of the United States or of foreign countries, in connection with official matters, may place stamps or make statements, notations, or additions to this passport. You may ammend or update p
    • "A digital picture in my passport"

      What if it were your Microsoft .NET Passport(TM)?

      Don't worry about the government robbing you of your freedom; businesses will do it themselves and charge you for the service.

  • All of these security measures are useless until we come up with a solution to people killing themselves to kill us.
  • Why it matters (Score:4, Insightful)

    by crow ( 16139 ) on Tuesday July 22, 2003 @02:30PM (#6501969) Homepage Journal
    I don't mind having my biometric information stored in my passport. What I care about is having my biometric information in a government database. Once the government starts collecting this information, they're going to save a copy for themselves. Then the database will be available whenever they want to determine who someone is, such as when analyzing photos of protests.
    • Re:Why it matters (Score:2, Interesting)

      by pyr0 ( 120990 )
      Not that you are necessarily from the US, but you do realize that current US passport photos are digital scans of the photo you already have to send them, right? And you don't think they save that photo in a database? As other posters have mentioned, it makes no difference whether it is stored on a chip on the passport or not in this case.
    • Once the government starts collecting this information, they're going to save a copy for themselves. Then the database will be available whenever they want to determine who someone is, such as when analyzing photos of protests.

      Why, that would be horrible... walking around in public and someone being able to recognize you.

      Or do you usually walk around with a paper bag over your head?
  • by MattRog ( 527508 ) on Tuesday July 22, 2003 @02:30PM (#6501970)
    It didn't mention this in the article so I thought I'd post here and ask. I just recently purchased a US passport which doesn't expire for 10 years. Will I be required to purchase the 'upgrade' to the new passport or can I continue to use it until it expires in 2013?

    With all the outstanding passports I couldn't imagine the US Gov would re-issue new ones for free. Hopefully we'll all be 'grandfathered' in, although since it is their property they could revoke them in Oct. 2004. :(
  • ... that I just renewed my passport. So for the next 10 years I can travel without any of the biometric "security features".

    After that? Don't know, stay at home I guess.

    M.
  • Interesting plan. (Score:3, Interesting)

    by Meat Blaster ( 578650 ) on Tuesday July 22, 2003 @02:31PM (#6501979)
    Adding a smart chip with biometrics is going to make it a lot harder for people to counterfeit these IDs. This is important even if not immediately relevant to the only event most people think of in connection to security.

    I think it'd be more interesting to make the passport work on more levels, though, such as encoding your driver's license and other relevant information to make it more convenient to use for identification (irregardless of what you're doing, you'd only have to carry one ID wherever you go.) Maybe even include an ability to pay with the card, with a credit issuer encoding their information in the chip -- use the card in a vending machine/gas pump/computer peripheral, verify with a fingerprint, and away you go.

    • > Adding a smart chip with biometrics is going to make it a lot harder for people to counterfeit these IDs.

      The problem with biometrics and government-issued 'encrypted' biometric data is that once the technology IS cracked (and it WILL be cracked - make no mistake about that!), then what do you do? You can't change your biometric data (well, not without plastic surgery or eye replacements :), so now you're always going to be identified as the person who did _whatever_the_thief_did. It's not like a user
  • by ahfoo ( 223186 ) on Tuesday July 22, 2003 @02:32PM (#6501989) Journal
    As someone who lives off his passport on a daily basis this seems like a gimick. Passports are totally insecure documents and always will be because they are used by people who leave their country and its laws behind.
    The real wake up call about passports happened for me when my first one expired. I had memorized the number and assumed that naturally this ultra important piece of ID would be kept for life --not a chance.
    I specifically requested to keep my old number and the feds said, no its not allowed.
    This struck me as totally bizarre, but by that point I'd travelled enough to have met people who casually threw away their passports and got new ones whenever they got into visa problems so I wasn't all that surprised. Passports are a joke and always will be.
  • by telbij ( 465356 ) on Tuesday July 22, 2003 @02:32PM (#6501992)
    When will the government learn that forward thinking foreign policy is an infinitely more efficient means of increasing security than technological card-house building.
    As much as I like the idea of more government tech jobs, I can't help but worry about our national security in the era of us-vs-them foreign policy.


  • This seems harmless. Just a tamper-proof mechanism to tie the photo to the passport. Right now, clever counterfitters can cut-n-paste photos on other people's passports. This would seemingly raise the bar above just having an exacto knife. THe photo on the chip is likely to be encrypted and also hashed with your passport ID number.
    • I don't know american passports, but my German passport has the pciture printed on the plastic and the plastic itself contains some holographs. So I doubt it is THAT easy to paste another picture into it.

      Not that my picture ever looked like me.

      M.
  • by HealYourChurchWebSit ( 615198 ) on Tuesday July 22, 2003 @02:32PM (#6502001) Homepage
    As the original contractor/code-monkey on the INSPASS project [immigration.gov], I'm amazed it only took 10 years to cut through enough of the beaurocratic B.S.

    Aside from the very REAL issue of "who owns the data," were battles over smart cards, chips, which biometric was better, how to store the data. I remember one prototype was a smart card augmented with a 2d barcode, a regular barcode, an OCR-B readable (for hand geometry), and a magstripe ... with a photo.

    Of course, precision of card printing being what it is, the photo would often obscure or otherwise make the data in the other formats unreadable.

    Now the question is how fast will they be able to look up the data at the ports of entry? Hopefully, the squabbling between INS and Customs is done and over. Back then, INS accessed a variety of "look-ups" via Customs. It wasn't pretty.

    Let's see if this not only makes the system more reliable, but speeds things up.
    • by Tackhead ( 54550 ) on Tuesday July 22, 2003 @02:49PM (#6502213)
      > As the original contractor/code-monkey on the INSPASS project,

      Automatic (+1, You Poor Bastard, how did you escape with your mind intact?)

      > I'm amazed it only took 10 years to cut through enough of the beaurocratic B.S.

      ObPeeve: "Bureaucratic".

      But apart from that. Damn. At least INS and Customs have been integrated under the same department. That's a start, but it's only a start. The acid test for BICE will be whether or not they can integrate their back-end infrastructure to avoid the problems you outline.

      > Of course, precision of card printing being what it is, the photo would often obscure or otherwise make the data in the other formats unreadable.

      I'd like to think that today's printers and scanners have gotten good enough that one could steganographically embed biometric data in the photograph. Joe BICEpack at the immigration desk couldn't verify its presence/veracity by eye, but he could sure as heck stick it under a scanner at the port of entry and see if his terminal pops up a warning, like "Picture biometric does not match passport printed data. Picture appears to match Mr. Foo Bar, SSN/ITIN AAA-BB-CC, A#123456789, Mr. Foo Bar is/isn't on watch lists X, Y, and Z. Mr. Foo Bar has/hasn't a track record of customs violations, etc. etc. etc."

      The one reservation I'd have about such an approach would be what happens if the scanner at the airport or border crossing gets coated with crud/residue after having processed thousands of passports a week. Perhaps a periodic recalibration with a "test card" (designed to be almost unreadable, worse than the average passport) after a spray on the scanner window with Windex or something could be part of the officer's morning routine. Get in, wipe window with rub, insert test card, re-wipe until test card says "OK", then open wicket for business with real passports.

      Fer the record, I hereby place that idea in the public domain. Anyone in .gov who wants to take credit for it is welcome to do so, especially if they can get it - or anything more secure - implemented in less than 10 years.

      To the privacy crowd: Privacy's good stuff. But the purpose of a passport is to provide proof of identity and citizenship. Unless you simultaneously advocate anonymous cross-border travel, policies which secure passports from exploits are perfectly compatible with privacy rights as they exist in law today, and as they existed in law before 9/11.

  • Having read the article, this is exactly the same as what they have now (read: A picture), only they're making it so it's harder to counterfit.

    *shrug* I actually think it's a good idea. Not nearly as intrusive as what the EU is doing, and makes things a bit harder to forge. Not more true security, I guess, but instead makes it better for the US to make sure everyone is legit.

    Nothing to worry about, unless these things dislike magnets as much as PCs do...

  • by indros13 ( 531405 ) * on Tuesday July 22, 2003 @02:35PM (#6502039) Homepage Journal
    Does anyone know how passports originated? My understanding is that they provided a way for countries in good relation to allow their citizens access across borders. This addition to the passport seems to be adding an additional layer (as the addition of a photograph did)--it's making a passport an personally identifiable certificate and not just a mark of a given nationality.

    My issue is this. A passport should allow me to travel to countries that are on good terms with the United States. It should also have some personal identification because the U.S. has to issue it to me and not just any American.

    But, is the addition of further features of personal identification the needless expansion of government knowledge of personal and private affairs (travel)? Or, is it a needful response to the the increasingly international and individual nature of crime and warfare (from international corporate criminals to terrorists)?

  • EMP people (Score:3, Interesting)

    by gr8_phk ( 621180 ) on Tuesday July 22, 2003 @02:35PM (#6502042)
    I can't wait to sneak someones passport into a microwave :-) A short range EMP device could then cause lots of trouble over lunch near the airport. I hope these things have regular pictures too, they're a little more durable.
  • by seldolivaw ( 179178 ) * <me&seldo,com> on Tuesday July 22, 2003 @02:38PM (#6502068) Homepage
    Leaving aside the privacy concerns of the biometric data, smart chips in passports are not a bad idea per se. As Frank Moss is quoted in the article: "you can read a chip and confirm its validity, but you cannot create one. That is the beauty of public key technology". And I have to say that's actually a very good reason for including chips -- it will be impossible to create fake passports. It will of course still be possible to duplicate existing ones... I wonder what percentage of fraudulent passports are "fake" as opposed to "altered"? It would be interesting to know.
    • well said. the use of pki is coming and I can't say I don't mind. now for the gubbament to store biometrics on their database and in our new passports? that to me sounds outrageous.

      why not just make a national standard in the state drivers licence with a smart card, leave the state up to the design, but keep a "standard" so that law enforcement can do their job a little easier.

      it may be easier to get our info, but then again... all it does is save them AND us time. especially when we're sitting in front o
  • Contactless? (Score:2, Insightful)

    by jswinth ( 528529 )
    Does that mean that someone (anyone?) can make a nice little data collection device and place it near a walkway at an international airport to collect this information? It is one thing to be forced to give this information when entering a country, it is quite another if someone can just sniff it. Am I missing something?
  • they'll tie it in the same way they tied in the partiot act when they said the governemnt needed more surviellance powers even though the governemnt already had their eyes on at least some of the hijackers before 911. THey will use fear and paranoia and money.
  • that they started putting full-face images in passports.
  • It's you! (Score:5, Funny)

    by verloren ( 523497 ) on Tuesday July 22, 2003 @02:40PM (#6502104)
    So now the immigration officials can state with absolute authority:

    "It's definitely you. I don't know who you are, or why you're here, but you're definitely you."

    Great.

    Cheers, Paul
  • No matter what you all think, biometric identification does increase security because everyone is unique. You may see this as just "He's who he is, that's great!" but there are much broader implications. Now, i'm not an advocate of face recognition or iris scanning, one because face recognition is a very faulty system, and iris scanning is very awkward because you have to be right next to the camera for a good picture. Take a technology such as fingerprinting and there you have what you need for safety.
    • "I think all of you against this technology need a reality check. No one is going to track us, they are merely keeping us safe."

      Here is a reply to your statement above from someone who is probably turning in his grave:

      "They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." Benjamin Franklin

      http://www.bartleby.com/100/245.1.html

  • I told you this was coming since the US put pressure on Canada to have National ID cards. I warned and warned and most people told me that they didn't care, there's nothing wrong with it. Now it'll be all over the world, try to escape if you can :)
  • America Fights Back! (Score:2, Interesting)

    by $criptah ( 467422 )
    Seriously, this is just another attempt by the U.S. government aimed to increase government spending and give a false sense of security to millions of Americans believe that yet another technological wonder will save our lives.

    I am afraid that this so-called bio-passport will let us fall in the path of high-tech internet boom of late nineties: everybody thought that Internet would positively change our lives and the way we did business, unfortunately nobody thought of outsourcing and digitally imported f
  • by 4/3PI*R^3 ( 102276 ) on Tuesday July 22, 2003 @02:45PM (#6502164)
    At least the printed passports required some special skills and some artistic ability to counterfeit. The idea that "because it's digital it's better" is falacious.

    I love the quote "you can read a chip and confirm its validity, but you cannot create one. That is the beauty of public key technology," from the Deputy Assistant Secretary for Passport Services. So they will digitally sign the data, how long will it take for some entity to crack the key and then they can sign the new passport. Once the key is cracked will the US government revoke all passports signed with that key?

    I can imagine the h@x0r application W1NPa55P0r7 -- with a USB camera and a simple EEPROM burner you can make your own passport.

    Since all the verification information is digital how will a simple security guard check to make sure you didn't just create a simple passport mimic circuit? At least with a physical passport a forgery requires printing equipment and skills that can't be purchased for under $20.00 at BestBuy.

    The trouble with most of these types of security measures is they offer no real security above what we already have.

    One basic concept of security is you never trust the client -- verify everything! All these security measures have all the data stored on the client! To make this more secure, each passport should contain a unique id and each passport check point should be networked to a central database. The passport reviewer would then see the picture stored on the passport, the picture stored in the central database, and the face of the person standing in front of him. If there are any discrepancies simply punch his ticket for Camp X-Ray.

  • by Phil Wherry ( 122138 ) on Tuesday July 22, 2003 @02:46PM (#6502172) Homepage
    It will be interesting to see how the public reacts to this. Done correctly, it will increase the security of the passport without really compromising privacy. If the format of the data on the smart card is completely documented, it will be easy to verify that the only information is being stored appears in printed form on the passport itself. Since all of the information in printed form is being stored someplace now, it's hard to argue that a smart-card version of this information disadvantages the traveler somehow.

    The presence of the digital signature, however, provides MUCH stronger assurances that these identity credentials aren't forged; this seems to me to be a very good thing indeed.
  • Is the guy winning the fight for non-freedom or what? We're learning from him, not the other way around.
  • Obvious (Score:4, Insightful)

    by supabeast! ( 84658 ) on Tuesday July 22, 2003 @02:49PM (#6502219)
    "How they tie this to '9/11 fears' is curious considering the hijackers had valid paperwork."

    The 9/11 hijackers had valid paperwork because various government agencies were not doing their jobs. These agencies are now under intense scruitiny, and are trying to do a better job to prevent potential terrorists from entering the country again. Smart chip passports will be much harder and more expensive to forge, making it harder for terrorists to travel using false identities. Overall, it's a small, important step in a larger program to keep the USA safe.
  • While I see why they would want to implement a system like this, has anyone answered the question of just how accurate biometrics are? I've heard that fingerprints taken from a crime scene can be 30-40% different from a "matching" print.
    So how accurate is facial recognition? or retinal scans? or even electronic fingerprint scans? I mean, with 32Kbytes, is that more than enough information to positively id someone?
  • I mean do we know for sure what exactly will the chip contain? It's not open source and we have no idea what kind of info will be put on this chip.

    I'm pissed off.
  • Some guy obviously found out a way to use this technology to cut corners and costs.
    Not to mention increased profits for whoever builds the passports.

    1 Majority dumb asses buy into changing passports because of 9/11
    2 ???
    3 Profit
  • How they tie this to '9/11 fears' is curious considering the hijackers had valid paperwork.

    Obviously this is just another grab at our rights and freedoms by an out of control government in the name of 9/11. Here they are changing U.S. passports, which will have no effect on third world country passports and people using them to gain entry into this country. At the same time the illegal allien problem gets worse in this country by the day, and those not caught at the boarder are free to do whatever they wa

  • by Myriad ( 89793 ) <myriad@the[ ]d.com ['bso' in gap]> on Tuesday July 22, 2003 @03:06PM (#6502371) Homepage
    The chip will contain a compressed full-face image for use as a biometric. European biometric passports, by contrast, are planned to feature both retinal and fingerprint recognition biometrics on their smart cards.

    What the article fails to mention is the most important aspect of the new design: the Terrorist Bit.

    As the above biometrics only help to ascertain that you are you, it was felt an added feature to easily separate the terrorists from the regular population was necessary.

    As such on the application form for your new passport will be a Terrorist checkbox. When the application is processed the Terrorist Bit is set accordingly.

    The bit may also be set at anytime by authorized representatives of the US Gov't such as the RIAA, and MPAA. In addition undercover officers looking for any Anti-American expressions or beliefs - including privacy advocates, anti-war activists, free software advocates, alternative energy supporters, and anyone generally disagreeing with the supreme-leader-of-free-nations, George W Bush.

    To ensure your security is of the highest order, each passport will include a unique license, the continuation of which requires an annual subscription fee. This license guarentees that no illegal copies of your passport can be made, its likeness replicated, or your identity compromised. The exact nature of the security measures taken are restricted for National Security reasons.

    Blockwars [blockwars.com]: a free multiplayer game

  • by panurge ( 573432 ) on Tuesday July 22, 2003 @03:33PM (#6502864)
    The problem with so many of these solutions is that they present a single point of failure. It's the problem with "universal" smart cards: only one thing to be stolen to create identity theft. In this case the theft is likely to occur at point of issue: how is the passport holder going to be identified when the passport is created? Once you have a passport with a false name in your biometrics,either by your fraud or by the collusion of a corrupt official, you are through the system and can leverage it to create new assets for your false identity.

    The best security relies on people knowing people and knowing things about people. An example: made to measure suits. If you belong to the social group that wears them, you will probably be able to recognise them on someone else. Unlike a car or credit card that can easily be stolen, a made to measure suit is effectively a biometric form of recognition. Nowadays, when a billionaire may wander around in jeans and T-shirt, it's harder for an investment banker to recognise a prospect.
    There are examples in the Bible (the ability to pronounce "shibboleth" being used to distinguish friend from foe.) and from WW2 (the Navajo talkers being used as an ultra-secure communications channel.) The upshot is that we now live in a society where people can be extremely anonymous, and this is a huge benefit to both terrorists and criminals.

    If we want to live in a society with high levels of security - and on the whole we seem to - we have to sacrifice some of our anonymity somewhere. Is it better to sacrifice anonymity at the local level (nosy neighbours) and have lots of little things that identify you to small groups of people who may be small minded, annoying or intrusive, or to sacrifice anonymity at the highest level (have a single point of identification which is apparently secure, but which is available to many people in government who may be corrupt or criminal?)

    I don't know the answer, by the way

  • digital != secure (Score:3, Insightful)

    by extrarice ( 212683 ) on Tuesday July 22, 2003 @04:02PM (#6503301) Homepage Journal
    The current trend is that if you add the word "digital", or some other computer-techie words to something, it's instantly better. It's just smokescreens and mirrors.

    Let's think about how a person would get one of these new passports:

    Like today, a person would conceivably need to have a photo taken somewhere to submit with the paperwork. A simple walk to a 1-hour-photo place will take care of that. Then this person, like today, will go to a govt. office to file the paperwork and sumbit the photo. Like today, the govt. employee will take the photo and paperwork, send it to someone who doesn't care if the photo and name match up - it's not his job, he just makes the passport - and several weeks later the applicant will get a letter in the mail with his passport. So what in this digital "biometric" data is stopping someone from getting a false ID (say, state drivers' licence), getting a photo, and submitting false paperwork to the govt. clerk in the hopes of getting a false passport? Better yet, since the digital photo is "signed" by the US Govt's private key, this false passport is even more authoritative and "legit" than my current (real) passport. Just wrap something in computer-speak, and instantly it's a whole lot safer, apparenly.

    The security of any system is only as good as it's weakest link. That weak link in this new passport system still is the human element. True security has three aspects: something you have (like a key), something you are (like a fingerprint or retina scan), and something you know (like a passphrase). Combining these three elements, it is extremely difficult to comprimise a system.
  • Already in place (Score:3, Interesting)

    by ajs ( 35943 ) <{ajs} {at} {ajs.com}> on Tuesday July 22, 2003 @04:31PM (#6503772) Homepage Journal
    The US Greencard already has all of this. Here's the data that goes into the greencard (I know this because I worked on it, but all of this is public):

    • Fingerprints (including the raw images and the derived info describing the fingerprint that can be searched for in a database).
    • Signature (data file containing scanned version)
    • Face (again, scanned)
    • Facial recognition reference data (? I think)
    • Various textual information one would find in a passport.
    • Laser-etched images of all US Presidents up to Clinton (if you look on the optical stripe on the back, that odd top line is actually a something-thousand DPI row of images) and various other counter-counterfiet items which range from trivial to very difficult to defeat.


    The greencard project was pretty fun, and I only worked on it briefly (no, I can't help you get one, I have no real ties to the folks that took over the project, and the project was run well so that "inside" information really didn't help you much -- everything I know that isn't useless serial driver crap, you can pretty much get by reading the press releases).

    The really funny part for me was the requirement that the card needed to be durable enough to remain readable for up to 5 years, stored in the shoe of a migrant worker. QA on that has to suck ;-)

1 + 1 = 3, for large values of 1.

Working...