Morning:
20°c
Johnny Depp has become, in his young middle age, like a star of the movies’ golden period
Secret deal hatched by News of the World to hush up details of phone-tapping was sealed in a tiny room at the Royal Courts of Justice
More...
New biometric passports can be cloned using £100 equipment sold over internet
Last updated at 23:22pm on 17.11.06
A simple microchip reader can clone the information from a passport.
Passports which have rocketed in value to make them more secure can be easily cloned using a microchip reader bought over the internet for less than £100.
The revelation is a huge embarrassment for the Home Office, which has increased the cost of travel documents by 60 per cent in less than a year.
The rise to £66 paid for the introduction of a supposedly-secure biometric chip on the passport, containing the owner's personal details and an image of their face.
The idea was to make it harder to produce a copy of a person's travel document.
But it has now emerged that a simple microchip reader, purchased from the Internet for £95.73, can clone the information - including the photograph.
It could then be used to produced an exact replica of the travel document, complete with a new microchip.
Opposition MPs called for the three million biometric passports issued since March this year from the Home Office's new £60m production lines to be recalled.
Nick Clegg, the Liberal Democrat home affairs spokesman, said: "Three million people now have passports that expose them to a greater risk of identity fraud than before.
"We need an urgent redesign of the biometric passport and a recall of all insecure passports once a new protected design is available."
The fiasco was exposed by the NO2ID campaign, which is concerned similarly poor security will dog the Government's £5 billion ID cards scheme.
They enlisted computer expert Adam Laurie to write a piece of software to suck such data from the chips - a task which took just 48 hours.
The software was then attached to the microchip reader, bought-legally from a UK-based company and dispatched within only four days. Three passports were then stripped of their data, which was loaded on to a laptop computer.
NO2ID said the Government had encrypted the data on the microchip to stop it being stolen - but had made basic mistakes.
Instead of producing a complicated code - the sequence of electronic numbers and letters which unlocks access to the information on the chip - they had simply applied a minimum set of rules published by the International Civil Aviation Authority.
These state the code should include the holder's passport number, date of birth and the document's expiry date - all of which would be clearly visible over the shoulder of somebody preparing to show it to a border guard.
The chip reader, once it knows the code, then has open access to steal the data which it contains.
Mr Laurie said: "The Home Office is using strong cryptography to prevent conversations between the passport and the reader being eavesdropped, but they are breaking one of the fundamental principles of encryption by using non-secret information published in the passport to create a 'secret key'.
"That is the equivalent of installing a solid steel front door to your house and putting the key under the mat."
Gus Hosein, an expert in information systems at the London School of Economics, said: "This is stupid technology. If chips can be cloned they will be used in counterfeit passports."
Phil Booth, of NO2ID, added: "The government is clearly derelict in its duty to protect the privacy and security of British citizens."
The Government opted to introduce the biometric passports after the US authorities - in the wake of September 11 - demanded new security measures on travel documents. Without the changes, any Briton wanting to travel to America would require a visa, causing chaos for millions of holidaymakers.
But it has since decided to make the passports the cornerstone of the ID card project, which is due to begin in 2008 or 2009.
As a result, the cost of a new passport has increased from only £42 in December 2005 to £66. The Home Office said cloning the chip 'doesn't matter'.
A spokesman said: "The information itself cannot be altered; the photo would still be the same so the copy would be of no use to an impersonator trying to use it fraudulently.
"Other than the photograph, which could be obtained easily by other means, they would gain no information that they did not already have - so the whole exercise would be utterly pointless."
Reader views (5)
Here's a sample of the latest views published.
This is what opponents of these Stalinist proposals have been saying all along, now they have proved it can be done. ID cards are a very expensive white elephant, needed only so the State can control our lives. When are so-called supporters going to wake up and smell the fraud? You people may want Blair et al tracking your every move, every thought, but my life is my life and NOT for the State to use to snoop into my privacy or sell on to marketing companies, or to be left open to unscrupulous civil servants out to make a quick buck from other peoples lives (and believe me, that really does happen). Get with reality, we ARE virtually living in a police state, thanks to the scum in Whitehall at the moment, stop blathering on about things you know nothing about and stand up for the rights of the citizens of this country!
- Jenny Hobson, Barry, Wales
Why use numbers or photos to prove your identity? Why not use something which cannot be faked...like fingerprints or a retina scan?
- Janet Fuls, Cottonwood, CA 96022
There was a Dr. Who episode years ago (Pirate Planet with Tom Baker if you remember) where the Doctor, upon finding a super-complicated electronic lock, is able to zap it with his sonic screwdriver. Whereupon he says something like, "The more complicated the lock, the easier it is to break it", meaning if they'd put a big bar and padlock on it he wouldn't have been able to do anything, but put complicated electronics on it and you can just short it out. Sounds to me like the government needs to sit down and watch a bunch of old episdoes of Dr. Who, old childrens' TV shows possesing more wisdom than they've got. It would be funny if it weren't so serious.
- Joe C, 29 Palms, CA USA
Lets wake up and get behind the Govt and ID cards.
- Craig, Glenrothes, Scotland
The Civil service know less about I/T than Info Technologists.
Again the standard of passport & digital formt is set by ICAO, and is not at a very high standard.
- Robert J M Barrett, Stuttgart, Germany
