Faked document with picture of Bin Laden fooled UN agency, newspaper reports
A British passport
New microchipped passports designed to protect against identity theft by terrorists and criminals can easily be faked, it was claimed today.
Tests showed that personal information could be cloned and manipulated within an hour before being inserted into new chips, the Times reported.
The paper said it had exposed “security flaws” in the passport system by asking a researcher to clone the chips on two British passports and implant digital images of Osama bin Laden and a suicide bomber. The altered chips were then passed as genuine by reader software used by the UN agency that sets the standards for such e-passports.
The tests showed that bogus biometrics could be inserted in fake or blank passports, the Times alleged, saying the flaws also undermined assertions that 3,000 blank passports stolen last week could not be forged.
The identity and passport service at the Home Office remained confident, however, that the British biometric passport was “one of the most secure passports available”, saying no one had been able to demonstrate they could modify or change information contained in a chip, and that if they did, it would be obvious to the reader.
A spokesman added: “Continuing investment in biometric technology and enhanced security measures will help ensure that passport security is maintained now and in the future.”
The tests for the Times were conducted by Jeroen van Beek, a security researcher at Amsterdam university who can read, clone and alter microchips so they are accepted by the software recommended for use at airports by the International Civil Aviation Organisation.
Van Beek could not be contacted today, but the Times said he had used his own software, a publicly available programming code, a £40 card reader and two £10 radio frequency chips. Within an hour, he had cloned and altered chips so that they were ready to be planted in stolen or fake passports.
A baby boy’s passport chip was altered to contain an image of Bin Laden, and that of a 36-year-old woman was changed to hold a picture of Hiba Darghmeh, a Palestinian suicide bomber who killed three people in 2003. The identities had been chosen deliberately to demonstrate that neither van Beek nor the Times was trying to fake viable travel documents, the newspaper said.
Van Beek was quoted as saying: “We’re not claiming that terrorists will be able to do this to all passports today or that they will be able to do it tomorrow. But it does raise concerns over security that need to be addressed in a more public and open way.”
The Times said its tests also raised questions about the £4bn identity card scheme, which relied on similar technology. The plan could open more opportunities for criminals to match real information about clients , including fingerprints and pictures, with stolen identity details.
An international system exists under which faked chips could be spotted at border points because they would not match key codes when checked against an international database. However, only 10 of the 45 countries with e-passports have signed up to the system, and only five are using it.
The Home Office says it will use the code directory from the end of this year, but the Times claims fakes from countries that do not share key codes could go undetected.
Wednesday August 06 2008 11:49 BST
Source: The Guardian