Feeds

Blank robbers swipe 3,000 'fraud-proof' UK passports

Game on for the passport fraudsters?

Beginner's guide to SSL certificates

A consignment of 3,000 "useless" blank biometric passports has been stolen on its way to British embassies throughout the world. Or at least, the Identity & Passport Service says they're useless.

IPS' claim is based on the standard, highly optimistic party line that, as the passports contain a chip, they can't be used to produce fake passports. The chip is intended to hold a copy of the data printed in the passport, so in order to produce a fully functional fake, a passport forger would need to overcome this hurdle. And even if they could, a check of the passport against UK records would reveal that it wasn't on file. The serial numbers of the passports are also known so they ought to show up on watchlists if the numbers aren't changed, while if they are, the numbers could be found to be false or incorrect.

Note however that most of these potential problems have been present for users of forged passports for any years, and that one of the reasons fakes are still valuable is that the circumstances in which the data is checked against central records tend to be fairly limited. A UK passport that will fail when checked against the 'gold standard' UK border control could nevertheless be useful for opening a bank account (if the bank is using the Passport Validation Service), as ID or to pass borders where the checks are less rigorous (which probably goes for the majority of the UK ones).

The serial numbers themselves are also less bulletproof than they might be. The numbers of UK biometric passports are generated using a readily reverse-engineerable system (from data such as date of birth and issuing office), so plausible versions, albeit ones that would fail a record check, can be produced.

IPS' presentation of the chip as the absolute, rock-solid guarantee of the document's integrity also has numerous holes in it. The passport is still valid if the chip isn't working, that's the rules, and while having a broken chip is likely to get you an extended interview at a UK border, the passport would still be useful for travel elsewhere, and would have a value even if the forger didn't bother blowing any data onto the chip.

Nobody has so far shown that data on the chip in a biometric passport can be successfully altered, but it has several times been shown that it can be copied fairly easily, and there are a number of ways in which this could be exploited. A copied chip that didn't match the passport data, for example, could be palmed and used to pass automated border controls of the sort that are currently being planned by IPS.

And it's still early in the relationship between forgers and biometric passports. One could perhaps envisage a future where businesses that regularly had to check passports (say, tourist hotels) could be 'farmed' by forgers for passport data, producing data banks of passports that hadn't been stolen, but that could be cloned on demand - just pick somebody the right age and appearance. Put that together with a stock of blank biometric passports and you've got a nice little business there. ®

Beginner's guide to SSL certificates

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Reducing the cost and complexity of web vulnerability management
How using vulnerability assessments to identify exploitable weaknesses and take corrective action can reduce the risk of hackers finding your site and attacking it.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.