Biometric passport

A biometric passport (also known as an electronic passport, e-passport or a digital passport) is a passport that has an embedded electronic microprocessor chip, which contains biometric information that can be used to authenticate the identity of the passport holder. It uses contactless smart card technology, including a microprocessor chip (computer chip) and antenna (for both power to the chip and communication) embedded in the front or back cover, or centre page, of the passport. The passport's critical information is printed on the data page of the passport, repeated on the machine readable lines and stored in the chip. Public key infrastructure (PKI) is used to authenticate the data stored electronically in the passport chip, supposedly making it expensive and difficult to forge when all security mechanisms are fully and correctly implemented.
Most countries are issuing biometric passports to their citizens. Malaysia was the first country to issue biometric passports in 1998. By the end of 2008, 60 countries were issuing such passports, which increased to over 150 by mid-2019.
The currently standardised biometrics used for this type of identification system are facial recognition, fingerprint recognition, and iris recognition. These were adopted after assessment of several different kinds of biometrics including retinal scan. Document and chip characteristics are documented in the International Civil Aviation Organization's (ICAO) Doc 9303 (ICAO 9303). The ICAO defines the biometric file formats and communication protocols to be used in passports. Only the digital image (usually in JPEG or JPEG 2000 format) of each biometric feature is actually stored in the chip. The comparison of biometric features is performed outside the passport chip by electronic border control systems (e-borders). To store biometric data on the contactless chip, it includes a minimum of 32 kilobytes of EEPROM storage memory, and runs on an interface in accordance with the ISO/IEC 14443 international standard, amongst others. These standards intend interoperability between different countries and different manufacturers of passport books.
Some national identity cards, such as those from Albania, Brazil, the Netherlands, and Saudi Arabia are fully ICAO 9303 compliant biometric travel documents. However others, such as the United States passport card, are not.
Biometric passports have protection mechanisms to avoid and/or detect attacks:
To assure interoperability and functionality of the security mechanisms listed above, ICAO and German Federal Office for Information Security (BSI) have specified several test cases. These test specifications are updated with every new protocol and are covering details starting from the paper used and ending in the chip that is included.
Since the introduction of biometric passports, several attacks have been presented and demonstrated.
Privacy proponents in many countries question and protest the lack of information about exactly what the passports' chip will contain, and whether they affect civil liberties. The main problem they point out is that data on the passports can be transferred with wireless RFID technology, which can become a major vulnerability. Although this could allow ID-check computers to obtain a person's information without a physical connection, it may also allow anyone with the necessary equipment to perform the same task. If the personal information and passport numbers on the chip are not encrypted, the information might wind up in the wrong hands.
On 15 December 2006, the BBC published an article on the British ePassport, citing the above stories and adding that:
and adding that the Future of Identity in the Information Society (FIDIS) network's research team (a body of IT security experts funded by the European Union) has "also come out against the ePassport scheme... [stating that] European governments have forced a document on its people that dramatically decreases security and increases the risk of identity theft."
Most security measures are designed against untrusted citizens (the "provers"), but the scientific security community recently also addressed the threats from untrustworthy verifiers, such as corrupt governmental organizations, or nations using poorly implemented, unsecure electronic systems. New cryptographic solutions such as private biometrics are being proposed to mitigate threats of mass theft of identity. These are under scientific study, but not yet implemented in biometric passports.
It was planned that, except for Denmark and Ireland, EU passports would have digital imaging and fingerprint scan biometrics placed on their RFID chips. This combination of biometrics aims to create an unrivaled level of security and protection against fraudulent identification papers . Technical specifications for the new passports have been established by the European Commission. The specifications are binding for the Schengen agreement parties, i.e. the EU countries, except Ireland, and the four European Free Trade Association countries—Iceland, Liechtenstein, Norway and Switzerland. These countries are obliged to implement machine readable facial images in the passports by 28 August 2006, and fingerprints by 26 June 2009. The European Data Protection Supervisor has stated that the current legal framework fails to "address all the possible and relevant issues triggered by the inherent imperfections of biometric systems".
Irish biometric passports only used a digital image and not fingerprinting. German passports printed after 1 November 2007 contain two fingerprints, one from each hand, in addition to a digital photograph. Romanian passports will also contain two fingerprints, one from each hand. The Netherlands also takes fingerprints and was the only EU member that had plans to store these fingerprints centrally. According to EU requirements, only nations that are signatories to the Schengen acquis are required to add fingerprint biometrics.
In the EU nations, passport prices will be:
In the EFTA, passport prices will be:
The ICAO standard sets a 35x45 mm image with adequate resolution with the following requirements:
Though some countries like USA use a 2x2 inch photo format (51x51 mm), they usually crop it to be closer to 35:45 in ratio when issuing a passport.