Recall demand after cloning of new biometric passports

[Shirley]

Recall demand after cloning of new biometric passports

Steve Boggan
Friday November 17, 2006
The Guardian


The government was facing demands to recall 3m micro-chipped biometric passports last night after a Guardian investigation which found that they could be electronically attacked and cloned with a £174 microchip reader.
Biometric data was transferred to a PC after gaining access to the chips in three passports. The findings are likely to put pressure on John Reid, the home secretary, to rethink plans for ID cards.

The Identity and Passport Service has spent £60m on new passport production lines for the £66 documents, which were introduced in March.

Story in full

[colhut]

The Register had a wonderfull article today on this. While I remain totally opposed to the whole ID card thing in any incarnation (its just the thin end of the wedge) the Guardians stunt was just that, its a demonstration of what has been done before already. The key point is they read the passport in exactly the way it was intended and just how it would be done legitimatly at passport control. Yes they extracted digital data from it, by using the correct security key (which is printed in machine readable text in the passport). In short anyone can do this with the right equipment and physical access to the passport. So far nobody has managed a brute force attack, ie extracting the digital data form a passport as it passes by a scanner and using sheer processing power to discover the security key.

[Muddypause]

I too am totally opposed to the ID card scheme, but I get a little concerned that we get distracted by this sort of thing. I am not against them on the grounds that they may be technologically flawed (or very expensive, or any number of other reasons); I am against them on basic moral principles.

Technological problems can be dealt with, budgets can be found, and this leaves those arguments foundering somewhat. But there can't be a workaround for the basic moral issue that they are wrong.

[Stonehead]

So far nobody has managed a brute force attack, ie extracting the digital data form a passport as it passes by a scanner and using sheer processing power to discover the security key.

That we know of!