Marrying Passports and Smart Cards

Oct. 4, 2004
Hastily arranged though it may be, this union's offspring could include millions of national ID cards and driver's licenses with chips and biometrics

Hastily arranged though it may be, this union's offspring could include millions of national ID cards and driver's licenses with chips and biometrics, as well as a new generation of electronic passports.

It has the feel of a shotgun wedding, with the U.S. government forcing the issue, but the marriage of smart card technology and passports is at hand. Facing a U.S.-imposed October 2005 deadline to begin issuing electronic passports carrying biometric data, many countries are making plans to order passports containing contactless smart card chips and antennas.

Contactless chips were chosen last year by the International Civil Aviation Organization, which sets travel documents standards for 188 member nations, as the best way to store biometric data for verifying the identity of travelers. Since then, passport agency officials have been criss-crossing the globe attending standard-setting meetings and vendor interoperability tests, all aimed at creating a system that would allow, for instance, a chip-based passport issued by Pakistan to be read by border guards in Brazil.

"It's turned out to be more work than we thought it would be," says Jean-Pierre Houle, e-passport project manager in the Canadian Passport Office, who says achieving interoperability has been the biggest hurdle. "You can do it within your own country, but when we started doing it with the world it became more complex."

Those technical issues remain troublesome, and some passport experts believe countries will move slowly while better specifications are developed. But there now seems no turning back, and the trickle of chip-based passports starting to appear this fall should turn into a torrent within a few years. What's more, similar technology is likely to start showing up in smart card-based national ID cards, frequent traveler cards and driver's licenses, boosting the impact of the e-passport mandate.

Even just counting passports, the demand is likely to be substantial. Industry sources say 110 million new and renewed passports are issued each year globally. When adding in visas and other border-crossing cards, U.S.-based consulting firm Dreifus Associates projects that the number of travel documents carrying contactless chips will grow from test quantities this year to an annual demand of 240 million units by 2008.

Opponents of electronic identification documents have made their own sweeping estimates for how many individuals worldwide will be carrying documents with biometric data, such as digital photos, fingerprints and iris scans. UK-based Privacy International predicts that more than 1 billion travelers will have their biometric data captured and stored by 2015 if the world's governments do not reverse the course set on their behalf by ICAO.

'Policy Laundering'
In fact, Gus Hosein, a senior fellow at Privacy International, says many governments are using the standards set by ICAO at the behest of the United States as a justification for introducing biometric-based passports without a thorough debate at the national level.

"National governments often say that consultation is unnecessary because they are merely adhering to 'international obligations,'" he says. "It is a great case of passing the buck, or as we call it, policy laundering."

The U.S. Congress got the ball rolling soon after the Sept. 11, 2001, terrorist attacks, by passing a law in 2002 requiring countries whose citizens can enter the United States without a visa to begin issuing tamper-resistant, machine-readable passports carrying biometric data by October 2004. Congress recently extended that deadline one year when it became apparent that many Visa Waiver nations could not meet the 2004 deadline.

There are 27 Visa Waiver countries, including most of Western Europe and Australia, New Zealand, Japan, Singapore and Uruguay. Some non-Visa Waiver countries plan to issue e-passports, as well, either to prepare for enrollment in the Visa Waiver program or to better secure their own borders, says Patrice Plessis, standardization manager in the ID and Security business unit of France-based smart card vendor Gemplus International SA. Hungary, Poland, Hong Kong and the United Arab Emirates are examples he cites.

The U.S. law required that the electronic passports-including the ones the U.S. will issue-comply with ICAO standards. That prompted the United Nations-affiliated agency to accelerate its work on defining a standard for high-tech passports.

In spring 2003, ICAO mandated that electronic passports carry an embedded contactless smart card chip and antenna so that countries could securely store biometric data while retaining the booklet format. Other technologies with the storage capacity to hold tens of thousands of bytes of data, such as contact smart card chips and optical stripes, would require use of a plastic card in place of the passport book.

ICAO also specified a digitized facial image as the minimum biometric stored on the chips, with countries permitted to also use fingerprint biometrics and iris recognition for added security.

Contract Awards
While the relative immaturity of contactless smart card technology posed unexpected challenges for passport officials (Card Technology, September 2004), governments have moved forward to seek bids and award contracts for chip-based passports.

Belgium became the first to issue ICAO-compliant passports this summer in a test with diplomatic personnel. Sweden and Denmark have awarded contracts for chip-based passports to be delivered in 2005, and the United States and Australia were expected to award contracts late last month. Other Visa Waiver countries are in various stages of moving to electronic passports, in some cases waiting for ICAO to finalize its specs or for the European Union to issue its requirements before putting contracts out to bid.

And several countries have made clear that they want to use smart card chips and biometrics in more than just passports.

In the United Kingdom, for example, the government announced last November a 10-year plan to introduce a family of ID documents with chips and biometrics. That plan was accelerated following the Madrid railway bombing in March, with talk of introducing a voluntary national ID card as early as 2007.

The government's plan is to offer an identity document carrying biometric data in at least three forms: the chip-based, ICAO-compliant passport booklet; a driver's license; or an identity card for those who have neither passport nor driver's license. Also under consideration is a passport on a smart card for those who only plan to travel to Europe, the United States and other countries where they would not need a paper visa.

As a first step, the UK government in April began a six-month test of facial, iris and fingerprint biometrics, aiming to enroll 10,000 volunteers. The test is being conducted jointly by the UK Passport Service, Home Office Identity Card Unit and the Driver and Vehicle Licensing Agency, which issues driver's licenses.

The political sensitivity of issuing a national identity card in Britain, where ID cards have been common only in wartime, has had Home Secretary David Blunkett waffling over whether the card would be voluntary or mandatory, and Prime Minister Tony Blair keeping his distance from the issue.

The government's current stance is that carrying any of the identity documents would be voluntary until 80% of the population enrolled, at which time Parliament would vote on making it mandatory to carry one of the three forms of identification, says John Elliott of UK-based Consult Hyperion. "To get to 80% they'd love the driver's license to be one of the three, because the 'voluntary uptake' would be compulsory for all drivers," Elliott says.

A Removable Card
Singapore has a somewhat similar vision to that of the UK in that it would like to see the same card that is used to enter the country also used for other purposes, including for securely transacting business over the Internet with a digital certificate stored in the smart card chip. Singapore's idea is to issue a smart card that could slip into a sleeve in an existing passport to meet U.S. requirements, but also be removed so that the citizen could use the chip card as a driver's license, national ID card and for commercial purposes, such as storing airline boarding passes.

ICAO allowed for the possibility of a removable smart card, but asked for a report on the technical implications of such a card, according to Singapore sources. Singapore made its first report on what it has named the Smart VIP card last month, and a follow-up discussion is scheduled for the next meeting of ICAO's New Technology Working Group in New Zealand in December.

The Smart VIP specification calls for a card with at least 32 kilobytes of available memory, contact and contactless interfaces, and the processing power to match a fingerprint biometric on the card itself so that card readers would not need that functionality.

The dual-interface chip is needed so that the card can be used with contact smart card readers attached to PCs-contactless readers are several times more expensive. That would allow citizens to identify themselves when accessing government services online. The project is being coordinated by the Infocomm Development Authority of Singapore, which promotes the use of information technology in the country, along with the Ministry of Home Affairs and Immigration and Customs Authority.

Frequent Fliers
Singapore also plans to use the smart card form factor in a test of an electronic passport with an application that allows travelers who have undergone background checks to move through airport security quickly.

Sources say the test will be conducted in conjunction with other members of the Asia IC Card Forum, an organization created in June by Asian governments seeking common smart card standards. Besides Singapore, the charter members are South Korea, China and Japan. The forum plans to invite other Asian nations to join.

In European countries, too, work on the electronic passport is going hand in hand with development of other high-tech ID documents.

In the Netherlands, where citizens already carry a national ID card, the technology being developed for chip-based passports may well find its way into a more sophisticated national identity document.

The Dutch Ministry of the Interior began a six-month test in August, with a goal of recruiting at least 15,000 volunteers to apply for a chip-based, biometric passport or national ID card at the same time as they sign up for today's chip-less documents. A 10-euro ($12) discount on the passport is offered as an incentive to attract volunteers, says Rudi De Bie, international sales director for Sdu Identification of the Netherlands, which is providing the passports and ID cards.

The test is meant to refine the process of enrolling citizens and issuing documents. A digital photo and two fingerprints of each volunteer will be collected and sent to Sdu's personalization center, which then produces a passport and ID card as it would if chip-based documents were the norm. The biometric-enabled documents are used to verify the identity of the citizen, but then collected. The citizen leaves with only the conventional passport or ID card, De Bie says.

De Bie says the U.S. mandate makes it likely the government will prioritize moving to chip-based passports after the test. However, he says, the test of the same technology in the national ID suggests the government will at least consider using contactless chips and biometrics in that card as well.

Sweden, too, may use some common technology in its passport and ID card. The Swedish national police agency, the Rikspolisstyrelsen, in August awarded a 100 million euro, five-year contract to Finland-based smart card and secure document supplier Setec Oy to supply both ICAO-compliant passports and the country's electronic ID, or EID card. Deliveries of both the chip-based passports and EID card are to begin by October 2005.

The EID card-which will contain a contact smart card chip, unlike the contactless chip in the passport-will be voluntary and carry a digital certificate for securing online transactions. In that respect, it will be similar to a card supplied by Setec to Finland, where some 40,000 citizens have been issued the document, says Pekka Eloholma, president and CEO of Setec.

Similar technology to that developed for passports also appears likely to show up in residency permits and visas issued by the European Union's 25 member states. The EU has decided that those documents will carry a facial image and two fingerprints, and a committee is examining the possibility of using a contactless smart card chip to hold that data, according to a spokesman for the European Commission's Justice and Home Affairs Department.

"The visa technology that is going to be used is fairly similar to the one you have in passports," says Jean-Claude Deturche, vice president of marketing for France-based smart card vendor Axalto. The main difference is that the chip will have to be packaged so that it can be contained in a paper visa, rather than in a thicker page in a passport book.

He says for countries that plan to put the chip into the back cover of the passport the standard thickness of the cover will be at least double today's 350 microns to support the inlay consisting of a contactless chip, antenna and packaging. The inlay itself will be 350 microns thick, Deturche says. He says the visa, today 100 microns thick, will become 350 microns thick to hold an inlay of no more than 250 microns.

The EU has mandated a common standard for all member countries' electronic passports, and release of that standard is expected by December. Some observers believe fingerprints will be optional on EU passports, even though they are required on visas and residency permits.

Much To Be Done
What all these projects have in common are potentially high volumes and relatively short deadlines. That combination has had vendors working overtime to develop new products and enhance old ones. Meanwhile, government officials and their consultants have been trying to fit the pieces together to meet their needs.

One new requirement that emerged quickly was for contactless chips with more memory. Until ICAO chose contactless chips for passports, the largest radio frequency chips had 8 kilobytes of rewriteable memory. But ICAO says 32K is the minimum needed for a passport, 64K is preferable and more room may be needed soon as nations make more use of biometrics.