E-Passports: Origin and Future Barry J. Kefauver OAS Workshop San Salvador June 9, 2008

Current Status There are over 40 countries issuing chip-based passports There are over 40 countries issuing chip-based passports More than 50% of the world’s passports are now chip-based More than 50% of the world’s passports are now chip-based There remain over 50 countries that need to develop machine-readable passport programs before the April 2010 deadline There remain over 50 countries that need to develop machine-readable passport programs before the April 2010 deadline Work continues to refine and enhance, but implementations go quite well Work continues to refine and enhance, but implementations go quite well The ICAO TAG met in May and decided on a work program for the coming several years The ICAO TAG met in May and decided on a work program for the coming several years

Fundamental Truth vs Urban Myth and c/Gen and c/Gen 2 Skimming Skimming - Reading the electronic data in an IC chip surreptitiously with a reader in the vicinity of the travel document. - Reading the electronic data in an IC chip surreptitiously with a reader in the vicinity of the travel document. Eavesdropping Eavesdropping - When data from an IC chip are intercepted by an intruder while it is being read from an authorized reader. - When data from an IC chip are intercepted by an intruder while it is being read from an authorized reader. Cloning Cloning - Copying the data that has been placed on a chip - Copying the data that has been placed on a chip - “Although he can clone the tag, (the hacker) says it's not possible, as far as he can tell, to change data on the chip, such as the name or birth date, without being detected. That's because the passport uses cryptographic hashes to authenticate the data.” - “Although he can clone the tag, (the hacker) says it's not possible, as far as he can tell, to change data on the chip, such as the name or birth date, without being detected. That's because the passport uses cryptographic hashes to authenticate the data.” Shielding and the Faraday cage Shielding and the Faraday cage

Testing History Canberra, Australia Morgantown, West Virginia, USA - A very significant event - Participants Sydney, Australia - Improved, but much work to be done Laboratory testing at US NIST Several other operational tests, e.g. BWI, Tsukuba, Berlin - Each one reflected improved interoperability

The So-What Test Pragmatics of mischief Pragmatics of mischief - Distance - Distance - Power - Power - Visibility - Visibility At what price? At what price? And then “what” do you have? And then “what” do you have?

Biometrics The only reason why we have a chip The only reason why we have a chip The early days post 9/11 The early days post 9/11 Evolution to the present Evolution to the present Germany launched fingerprint November 2007 Germany launched fingerprint November 2007 Coming challenges Coming challenges

Not Just a Chip The e-passport is everything that non-e passports are, but in addition, with a chip Inks OVD’s of many hues and flavors Paper and accompanying measures to protect Watermarks of various technologies Security printing Many other physical features

False News Makes For Headlines We broke the Dutch Passport We broke the Dutch Passport There were only politicians who drafted 9303 There were only politicians who drafted 9303 JPEG 2000 flaw crashes any reader JPEG 2000 flaw crashes any reader Belgian passport fails Belgian passport fails UK passport not for its purpose UK passport not for its purpose E-passport is a “beacon” for terrorists E-passport is a “beacon” for terrorists

New Initiatives Information and data sharing, real time communications capability Information and data sharing, real time communications capability Centralized civil registry databases Centralized civil registry databases Shift from counterfeits to fraudulent genuines Shift from counterfeits to fraudulent genuines Numerous online enrollment and other-services programs are being deployed Numerous online enrollment and other-services programs are being deployed A need for standards to smooth information A need for standards to smooth information gathering and sharing prior to departure gathering and sharing prior to departure Identity theft has captured worldwide attention and concern Identity theft has captured worldwide attention and concern

So---Now What The story needs to be told The story needs to be told What it does FOR you rather than TO you What it does FOR you rather than TO you Now is the time to tell the biometrics story Now is the time to tell the biometrics story

Thank you for your attention… QUESTIONS? Barry J. Kefauver