EUROPEAN COMMISSION Brussels, 8.12.2016 COM(2016) 790 final COMMUNICATION FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL Action plan to strengthen the European response to travel document fraud



I.INTRODUCTION The increasingly significant problem of travel document fraud has come under the spotlight in the context of the recent terrorist attacks in Europe and current migration flows. Document fraud has become an enabler of terrorism and organised crime, and is linked to the trafficking of human beings and migrant smuggling. It is vital that we enhance the security of travel documents, including the underlying identity management infrastructure. In its Communication on Enhancing security in a world of mobility: improved information exchange in the fight against terrorism and stronger external borders, the Commission stressed the crucial importance of secure travel and identity documents wherever it is necessary to establish beyond doubt a person’s identity and announced that it would be presenting an action plan to tackle the phenomenon of travel document fraud. An improved approach will rely on robust systems to prevent abuses and the threats to internal security arising from failings in document security. Most commonly, travel documents take the form of passports, but they also include national identity cards and residence permits for third country nationals (when used within the area without controls at internal borders). EU citizens can enter and leave the EU, the Schengen area and certain nonEU countries with a national ID card issued by Member States. This means, for example, that foreign terrorist fighters may be able to travel between the EU and Turkey using just their national ID card. EU travel documents are in high demand among fraudsters. At least three quarters of fraudulent documents detected at the external borders, but also in the area without controls at internal borders, purport to have been issued by EU Member States and the Schengen associated countries. According to recent reports from the European Border and Coast Guard, less secure national ID cards issued by Member States are the most frequently detected false documents used for intraSchengen travel. ‘Lookalike fraud’ (where the holder of a document is simply a look-alike of its real owner) is still on the rise and remained the most frequently reported type of fraud in the second quarter of 2016. Obtaining authentic documents on the basis of false ‘breeder’ documents (birth, marriage and death certificates) remains one of the biggest threats, as it is very difficult to detect. Against this background, it is crucial that the EU and especially the Member States intensify efforts to improve the security of travel documents issued to EU and third country nationals. Travel document security is an important factor in better border protection and migration management and the move towards an effective and genuine Security Union. The nature of travel document fraud is evolving rapidly. Criminal networks involved in the falsification and counterfeiting of travel documents are now more specialised and are constantly developing new forms of forgery, such as the manipulation of anti-forgery devices and techniques to circumvent biometric checks, and new modus operandi. The introduction of more sophisticated security features, production methods and document inspection systems is making it more difficult to forge or counterfeit identity and travel documents. In response, however, fraudsters are increasingly shifting from ‘traditional’ fraud – which focuses on the physical document, for example by altering the date of validity in a passport (forgery) or producing a totally fake document (counterfeit) – to other types of document fraud, such as lookalike fraud. They are also targeting other types of documents, such as the breeder documents used to support applications for genuine travel documents. According to the European Border and Coast Guard’s 2016 report, impostor fraud and the fraudulent obtaining of genuine documents increased by 4 % and 76 % respectively between the first quarter of 2015 and the first quarter of 2016, whereas fraud with counterfeit documents decreased (-8 %). This Communication sets out an action plan to improve the security of travel documents. Security standards for travel documents and border control requirements are set at EU level, but Member States retain full responsibility for the breeder documents and actually producing and issuing travel documents. The action plan sets out measures which the Commission will take and makes recommendations for Member State action under national policies on all aspects of travel document security. The Commission and Member States have to ensure that fundamental rights in particular the right to personal data protection, will be guaranteed in all measures referred to in this action plan. As guardian of the Treaties, the Commission will continue to monitor the correct implementation of EU law and use its powers to enforce correct implementation where appropriate and necessary. II. ACTION PLAN 1. Registration of identity Authentic documents established on the basis of a false identity are very difficult to detect at border crossings or within a Member State’s territory. Individuals’ identity should be established, and ‘breeder documents’ issued, on the basis of population registers containing relevant uptodate historical, social and geographical data. Countries with a biometric population register or travel document database can check a person’s identity each time s/he applies for a new travel document, so a person cannot apply for an authentic document using a false breeder document. While it can be legal for a person to change his or her name, close attention needs to be paid to this process and the procedures must be watertight. Where adults are registering or applying for a passport for the first time (e.g. following naturalisation) and no reliable registration data are available, the authorities responsible should conduct face-to-face interviews and, as appropriate, look for additional evidence that the person actually uses the claimed identity, for example, via electoral rolls or social security records. In addition, breeder documents should have a minimum security level to prevent falsification. The EU has contributed a total of EUR 16 million to research and development initiatives to ensure more secure breeder documents. Future Horizon 2020 work programmes on Secure Societies 2018-2020 will support R&D on document security. Beyond the EU, there are projects in the framework of the new Partnership Framework under the European Agenda on Migration to develop biometric registration databases in key partner third countries with capacity to ensure functioning civil registries and fingerprint or biometric digitalisation. Europol has funded the development of a handbook on the detection of false breeder documents. It contains samples and short descriptions of European ID documents and breeder documents, but it is not used as much as it should be.

Electronic identification and trust services for electronic transactions, can also help in the detection of false documents and enhance electronic document security by providing evidence of identity and preventing ID fraud through the mutual online validation of identity data. They would also support the facilitation of secure online applications for the renewal of travel documents. A recently adopted Regulation simplifying the circulation of public documents in the Union establishes that birth and marriage certificates issued in one Member State can be accepted as authentic in another without an authentication stamp. This strengthens the fight against fraud by introducing administrative cooperation whereby Member States communicate with each other, via the Internal Market Information (IMI) system, in cases of doubt as to the authenticity of a public document, for example, to check the authenticity of breeder documents. Specific actions Member States should: -consider how best to avoid issuing authentic documents based on false identities, for example through reinforcing procedures in cases of laterinlife registration of identity/firsttime applications or namechanging; -examine how their breeder documents can be made more fraudresistant, e.g. by adding security features; -ensure wide distribution of the Europol handbook on breeder documents to all documentissuing authorities and promote its continued use; and -swiftly implement the Regulation on promoting the free movement of citizens by simplifying the requirements for presenting certain public documents in the EU and exploit its potential to enhance public document security through use of the Internal Market Information system. The Commission will: -assess the current situation in Member States, and facilitate discussion on biometric identifiers (facial image and/or fingerprints) in population registers, in full respect of EU data protection law and taking account of the national context in Member States; -facilitate discussion on how breeder documents can be made more secure, from the second quarter of 2017; -work with key partner third countries to promote and support the introduction of biometric identifiers in their population registers; -strengthen R&D activities in the area of breeder documents and document verification, including the evaluation of mobile technologies, in the framework of the Horizon 2020 programme for Secure Societies 2018-2020; and -monitor implementation of the Regulation on promoting the free movement of citizens by simplifying the requirements for presenting certain public documents and assess its potential to further enhance electronic public document security. 2. Issuance of documents At the Council meeting in December 2005, all EU Member States adopted conclusions on minimum standards relating to the security of issuing processes for Member States’ identity cards. This was followed up by a Resolution in 2006. The recommendations address the issuance of ID cards to be used as travel documents, but they are relevant for all travel documents. Nevertheless, some (for instance, requiring applicants to apply in person and monitoring the whole issuing process) are still not fully implemented. It is important that Member States exchange best practices as regards both biometrics enrolment and document granting and issuing procedures, in order to achieve greater coherence between national practices. The Commission will facilitate this by organising workshops and ad hoc meetings. We know that decentralised issuance processes make it easier for fraudsters to steal and reuse blank documents. Centralising and monitoring/auditing issuing and personalisation processes (fillingin of blank documents) prevent the circulation of (in particular, blank) stolen documents. Specific actions Member States should: -ensure full implementation of the 2006 Resolution on minimum standards as regards the security of issuing processes; -exchange information on best practices regarding biometrics enrolment and document granting and issuance procedures; and -strengthen the monitoring of the personalisation/issuance of identity and travel documents in order to limit the number of blank stolen items. The Commission will: -facilitate the exchange of best practices on issuing procedures and identity management by organising workshops from the first quarter of 2017. 3. Document production 3.1 Security features in travel documents EU legislation has been adopted on standards for security features and biometrics in passports and travel documents issued by Member States and on uniform formats for visas and residence permits for nonEU nationals. These standards are also used for local border permits and permits issued in the framework of the legal migration acquis. The relevant technical specifications for documents are continuously updated to prevent fraud and it is thus important that documents are produced in full conformity with the latest versions of these technical specifications. The Commission has presented two proposals to upgrade security features and establish a new design for visa and residence permits for third country nationals. The rapid adoption of these proposals would help to reduce the use of forged documents to enter the area without controls at internal borders. Currently, security levels of national ID cards delivered by Member States and of residence documents for EU nationals residing in another Member State and their family members vary significantly, which increases the risk of falsification and document fraud as well as leading to practical difficulties for citizens when they seek to exercise their right of free movement. As a follow up to the 2013 EU Citizenship Report and as noted in the Communication of 2016 "Enhancing security in a world of mobility", the Commission launched a study to further assess security issues, including a possible harmonisation of security features to enhance their resistance against document fraud risks. Enhancing the security features of ID and residence documents could also help address the problem noted in recent reports of the European Border and Coast Guard that national ID cards with a lower security level are the most frequently detected false documents. In the context of the right to consular protection enjoyed by EU citizens whose Member States do not have diplomatic or consular representation in a third country, another Member State might need to issue Emergency Travel Documents to such citizens. A Decision from 1996 established a common format for such Emergency Travel Documents to enable the citizens to travel home. Issuing Emergency Travel Documents constitutes the most frequent type of consular assistance. After 20 years, this Decision is outdated. Some Member States do not use the Emergency Travel Document due to the fact that it is considered unsecure against document fraud. In the context of this revision, the Commission will explore possibilities also to modernise security features of Emergency Travel Documents. 3.2. Enrolment of biometrics EUlevel guidelines have been adopted for authorities enrolling biometric identifiers in passports and residence permits for third country nationals. This is a very important task, as most non-matches at border control are caused by the faulty enrolment of data at the time of issue. Biometric quality is the most important parameter affecting the accuracy of automatic biometric systems. Biometric vulnerabilities such as ‘face-morphing’ and ‘fingerprint spoofing’ should also be addressed. Specific actions The European Parliament and the Council should: -adopt as soon as possible the proposals on a more secure uniform format for visas and residence permits for third country nationals to avoid further fraud. The Commission will: -in the first quarter of 2017, finalise the study on EU policy options to improve the security of EU citizens’ ID cards and the residence documents of EU citizens residing in another Member State and of their non-EU family members in order to limit the risk of fraud and forgery. The Commission will evaluate the next steps, options and their impacts, in view of a possible legislative initiative by the end of 2017. -examine whether there is a need to amend Regulation (EC) No 1931/2006 to ensure that the conditions for issuing local border traffic permits, and the security features of the permits, guarantee appropriate security risk assessments while not prejudicing in any way the benefits of the Regulation and the Schengen Borders Code for the permit holders. -develop further guidance/training for the correct enrolment of biometric identifiers, in particular to address biometric data quality and vulnerabilities from the third quarter of 2017 and -monitor the conformity of security features of travel documents issued by Member States against EU technical specifications.

4. Document control The Schengen Borders Code sets out procedures for checks on EU and nonEU nationals at the external borders. Border guards have to perform these checks quickly and rely on technologies/databases, training and guidance tools to enable them to verify travel documents. 4.1 Electronic checks on nonEU nationals’ travel documents The electronic verification of the authenticity of nonEU nationals’ travel documents is an essential component of the future Entry/Exit System; it contributes to security, as it helps to detect and combat identity fraud and the misuse of travel documents. In addition, the system will combat identity fraud by managing nonEU nationals’ biometric identity, in much the same way as the Visa Information System does for visa-holders. The two systems are closely interconnected for these purposes. Obtaining certificates from nonEU countries (country signing certification authorities) to authenticate the travel document is a time-consuming and sensitive process, but it is necessary to make sure that the chain of trust from the ‘producer’ of the certificate to the ‘consumer’ (user) is unbroken. The Commission started a pilot project in 2015 to explore how to collect nonEU country certificates, validate their trust level and subsequently share them in the form of a ‘masterlist’ complying with an International Civil Aviation Organisation specification. As of 2017, this ‘masterlist’ could simplify and further promote the electronic authentication of nonEU country travel documents for all Member States. 4.2 Database checks Document holders should immediately report the loss or theft of their documents. If Member States enter the information promptly in the Schengen Information System (SIS) and Interpol’s stolen and lost travel document database, as they are legally required to do, it greatly reduces the chances of identity fraud. As of 24 November 2016, there were over 52 million SIS alerts on issued documents and 1 million for blank documents. In 2015, there were around 18 500 hits for issued documents. Member States should also pass on to Interpol data on lost, stolen or misappropriated travel documents issued by nonEU countries so that it can enter the data into the stolen and lost travel document database where possible. This is particularly important in relation to fraudulently obtained Syrian travel documents, for example. The stolen and lost travel document database contains over 68 million records, which were searched over 1 243 billion times between January and September 2016, resulting in over 115 000 hits. The proposed amendment of the Schengen Borders Code would make it obligatory to verify all travel documents, regardless of the holder’s nationality, against the SIS and the stolen and lost travel document database. This would make it easier to identify lost, stolen, misappropriated or invalidated documents and to seize them or preserve them as evidence. In addition, the proposed European travel information and authorisation system (ETIAS) should make it possible to check visaexempt nonEU nationals’ travel documents against the SIS and the stolen and lost travel document database prior to their arrival at the external borders. The HighLevel Expert Group on Information Systems and Interoperability is looking at how interoperability could contribute to improved document and identity checks. 4.3 Training Member States, competent EU agencies and the Organisation for Security and Cooperation in Europe (among others) have developed training for border guards on the detection of document fraud. This needs constant updating, notably to focus on new forms of fraud, such as look-alike fraud, and to address all those involved in verifying documents, such as carriers, consular staff and local administrations. The Carriers Liability Directive provides for financial penalties for carriers who transport nonEU nationals lacking the necessary documents for entry to the EU. Further consideration should be given to including suitable provisions on training for carriers in order to improve the detection of document fraud. 4.4 Tools Available tools to help police officers, border guards and others to detect document fraud include the false and authentic documents online database (FADO), which is a European image database with standardised descriptions, in the 24 official EU languages, of document security features and falsification techniques and several link option functions providing direct access to other documentrelated databases, as well as national and commercial applications. FADO was set up in cooperation between Member States and should be brought within an EU legal framework. At present, Member States are under no legal obligation to upload documents (whether their own authentic ones or falsified ones they have detected) and this results in wide variation in the extent of contributions as regards both their own and nonEU country documents. In addition, actual use of the database is still limited. An analysis should be carried out on the added value of the system and on whether improvements are necessary. Apart from the police and border authorities, civil and private entities that need to perform identity checks for various reasons also rely on the use of genuine travel and identity documents. The ‘non-document-expert’ community should also be able to rely on simple authentication mechanisms that do not require expert knowledge or specialised equipment. Non-experts and the general public have access to a subsystem of FADO which provides less detailed information. Means should be explored of giving them wider access to lost or stolen document alerts, databases on genuine documents and recent alert information on fraud trends. 4.5 Biometrics in travel documents Biometric identifiers are an important tool for detecting fraud. Border control officials can use them to establish identity, in particular by comparing the data on the chip with those on the document. In order to check the electronic components of e-passports and e-residence permits, the authorities need the Member State that has issued the document to provide them with the requisite certificates so that they can access the fingerprints stored on the chip. The systematic electronic checking of the chip data would lead to the detection of the most common cases of document fraud, such as manipulations of the photo of the holder. Unfortunately, not all Member States exchange their certificates.