Feeds

Blank robbers swipe 3,000 'fraud-proof' UK passports

Game on for the passport fraudsters?

Website security in corporate America

A consignment of 3,000 "useless" blank biometric passports has been stolen on its way to British embassies throughout the world. Or at least, the Identity & Passport Service says they're useless.

IPS' claim is based on the standard, highly optimistic party line that, as the passports contain a chip, they can't be used to produce fake passports. The chip is intended to hold a copy of the data printed in the passport, so in order to produce a fully functional fake, a passport forger would need to overcome this hurdle. And even if they could, a check of the passport against UK records would reveal that it wasn't on file. The serial numbers of the passports are also known so they ought to show up on watchlists if the numbers aren't changed, while if they are, the numbers could be found to be false or incorrect.

Note however that most of these potential problems have been present for users of forged passports for any years, and that one of the reasons fakes are still valuable is that the circumstances in which the data is checked against central records tend to be fairly limited. A UK passport that will fail when checked against the 'gold standard' UK border control could nevertheless be useful for opening a bank account (if the bank is using the Passport Validation Service), as ID or to pass borders where the checks are less rigorous (which probably goes for the majority of the UK ones).

The serial numbers themselves are also less bulletproof than they might be. The numbers of UK biometric passports are generated using a readily reverse-engineerable system (from data such as date of birth and issuing office), so plausible versions, albeit ones that would fail a record check, can be produced.

IPS' presentation of the chip as the absolute, rock-solid guarantee of the document's integrity also has numerous holes in it. The passport is still valid if the chip isn't working, that's the rules, and while having a broken chip is likely to get you an extended interview at a UK border, the passport would still be useful for travel elsewhere, and would have a value even if the forger didn't bother blowing any data onto the chip.

Nobody has so far shown that data on the chip in a biometric passport can be successfully altered, but it has several times been shown that it can be copied fairly easily, and there are a number of ways in which this could be exploited. A copied chip that didn't match the passport data, for example, could be palmed and used to pass automated border controls of the sort that are currently being planned by IPS.

And it's still early in the relationship between forgers and biometric passports. One could perhaps envisage a future where businesses that regularly had to check passports (say, tourist hotels) could be 'farmed' by forgers for passport data, producing data banks of passports that hadn't been stolen, but that could be cloned on demand - just pick somebody the right age and appearance. Put that together with a stock of blank biometric passports and you've got a nice little business there. ®

Internet Security Threat Report 2014

More from The Register

next story
Phones 4u slips into administration after EE cuts ties with Brit mobe retailer
More than 5,500 jobs could be axed if rescue mission fails
JINGS! Microsoft Bing called Scots indyref RIGHT!
Redmond sporran metrics get one in the ten ring
Driving with an Apple Watch could land you with a £100 FINE
Bad news for tech-addicted fanbois behind the wheel
Murdoch to Europe: Inflict MORE PAIN on Google, please
'Platform for piracy' must be punished, or it'll kill us in FIVE YEARS
Phones 4u website DIES as wounded mobe retailer struggles to stay above water
Founder blames 'ruthless network partners' for implosion
Found inside ISIS terror chap's laptop: CELINE DION tunes
REPORT: Stash of terrorist material found in Syria Dell box
Sony says year's losses will be FOUR TIMES DEEPER than thought
Losses of more than $2 BILLION loom over troubled Japanese corp
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.