Download 'Too Hot', an exclusive Specials track from iTunes

New microchipped passports designed to be foolproof against identity theft can be cloned and manipulated in minutes and accepted as genuine by the computer software recommended for use at international airports.
Tests for The Times exposed security flaws in the microchips introduced to protect against terrorism and organised crime. The flaws also undermine claims that 3,000 blank passports stolen last week were worthless because they could not be forged.
In the tests, a computer researcher cloned the chips on two British passports and implanted digital images of Osama bin Laden and a suicide bomber. The altered chips were then passed as genuine by passport reader software used by the UN agency that sets standards for e-passports.
The Home Office has always argued that faked chips would be spotted at border checkpoints because they would not match key codes when checked against an international data-base. But only ten of the forty-five countries with e-passports have signed up to the Public Key Directory (PKD) code system, and only five are using it. Britain is a member but will not use the directory before next year. Even then, the system will be fully secure only if every e-passport country has joined.
Some of the 45 countries, including Britain, swap codes manually, but criminals could use fake e-passports from countries that do not share key codes, which would then go undetected at passport control.
The tests suggest that if the microchips are vulnerable to cloning then bogus biometrics could be inserted in fake or blank passports.
Tens of millions of microchipped passports have been issued by the 45 countries in the belief that they will make international travel safer. They contain a tiny radio frequency chip and antenna attached to the inside back page. A special electronic reader sends out an encrypted signal and the chip responds by sending back the holder’s ID and biometric details.
Britain introduced e-passports in March 2006. In the wake of the September 11 attacks, the United States demanded that other countries adopt biometric passports. Many of the 9/11 bombers had travelled on fake passports.
The tests for The Times were conducted by Jeroen van Beek, a security researcher at the University of Amsterdam. Building on research from the UK, Germany and New Zealand, Mr van Beek has developed a method of reading, cloning and altering microchips so that they are accepted as genuine by Golden Reader, the standard software used by the International Civil Aviation Organisation to test them. It is also the software recommended for use at airports.
Using his own software, a publicly available programming code, a £40 card reader and two £10 RFID chips, Mr van Beek took less than an hour to clone and manipulate two passport chips to a level at which they were ready to be planted inside fake or stolen paper passports.
A baby boy’s passport chip was altered to contain an image of Osama bin Laden, and the passport of a 36-year-old woman was changed to feature a picture of Hiba Darghmeh, a Palestinian suicide bomber who killed three people in 2003. The unlikely identities were chosen so that there could be no suggestion that either Mr van Beek or The Times was faking viable travel documents.
“We’re not claiming that terrorists are able to do this to all passports today or that they will be able to do it tomorrow,” Mr van Beek said. “But it does raise concerns over security that need to be addressed in a more public and open way.”
The tests also raise serious questions about the Government’s £4 billion identity card scheme, which relies on the same biometric technology. ID cards are expected to contain similar microchips that will store up to 50 pieces of personal and biometric information about their holders. Last night Dominic Grieve, the Shadow Home Secretary, called on ministers to take urgent action to remedy the security flaws discovered by The Times. “It is of deep concern that the technology underpinning a key part of the UK’s security can be compromised so easily,” he said.
The ability to clone chips leaves travellers vulnerable to identity theft when they surrender their passports at hotels or car rental companies. Criminals in the back office could read the chips and clone them. The original passport holder’s name and date of birth could be left on the fake chip, with the picture, fingerprints and other biometric data of a criminal client added. The criminal could then travel the world using the stolen identity and the original passport holder would be none the wiser.
The Home Office said last night that it had yet to see evidence of someone being able to manipulate data in an e-passport. A spokesman said: “No one has yet been able to demonstrate that they are able to modify, change or alter data within the chip. If any data were to be changed, modified or altered it would be immediately obvious to the electronic reader.”
The International Civil Aviation Organisation said: “The PKD ensures that e-passports used at border control points . . . are genuine and unaltered. In effect it renders the passport fool-proof. However, all states issuing e-passports must join the PKD, otherwise that assurance cannot be given.”
Going biometric
1999 International Civil Aviation Organisation begins study into possibility of worldwide use of travel documents carrying biometric data
2002 After 9/11 US announces all passports issued from 2006 and used to enter the country must contain biometric information or holder will require a visa
2006 Britain and many EU countries introduce biometric passports
2008 45 countries have introduced biometric passports. 100 million have been issued globally
Sources: Identity and Passport Service, US Government
Win a luxury weekend to Newcastle and its neighbour Gateshead, find out more here
Risk, resilience and embracing new technology
Industry sectors news at a glance. Interactive heatmap, video and podcast
Discover the power of collective thinking. Submit a solution and be in with a chance to win a Media Hub Home Entertainment System
The inside track on current trends in the charity, not for profit and social enterprise sectors
Everything the Business Traveller needs to know to make a better trip
Make the most of the summer and enter our fabulous photographic competition, you could win a £5000 holiday
Corsica is an island of beauty and contrast, an ideal holiday destination
Enjoy further reading from Travel to Fashion, Business to Sport, discover more
Shortcuts to help you find sections and articles
The clever way to lease a new car is with Car leasing made simple™
2009
per month on 36-month
Personal Contract Hire (PCH)
2008
42850
Car Insurance
£24,250 - £30,346
MI5
London
£60,000
The Environment Agency
Bristol
Up to £90K
Boots
Midlands
OTE £85k
Credit Protection Association
Nationwide Opportunities
Completely London
Luxury Condo's in Manhattan with NYC views
The best new homes in Wimbledon?
Nationwide
Fabulous Cruise And Cruise & Stay Offers Including Virgin Atlantic Flights Prices Start From Only £699pp!
Last Minute Cruise And Cruise & Stay Offers. Med From £499pp, Caribbean From £699pp!
5 star quality at a 3 star price.
8 fabulous Canadian cities ...you won’t find cheaper
Contact our advertising team for advertising and sponsorship in Times Online, The Times and The Sunday Times, or place your advertisement.
Times Online Services: Dating | Jobs | Property Search | Used Cars | Holidays | Births, Marriages, Deaths | Subscriptions | E-paper
News International associated websites: Globrix Property Search | Property Finder | Milkround
Copyright 2009 Times Newspapers Ltd.
This service is provided on Times Newspapers' standard Terms and Conditions. Please read our Privacy Policy.To inquire about a licence to reproduce material from Times Online, The Times or The Sunday Times, click here.This website is published by a member of the News International Group. News International Limited, 1 Virginia St, London E98 1XY, is the holding company for the News International group and is registered in England No 81701. VAT number GB 243 8054 69.
Say no to biometrics and ID cards.
Adam, Cheltenham, England
These passports are as trustworthy as electronic votes on voting machines!
BTW, the 9/11 hijackers (those not still alive!) may have gotten legit passports"
"MICHAEL SPRINGMAN: In Saudi Arabia I was repeatedly ordered by high level State Dept officials to issue visas to unqualified applicants.."
John S Carpenter, Portland ME, USA
we are giving up our freedoms and liberties for worthless pieces of paper that will not save one life.
if we spent the billions we are wasting on this project on global development, cut trade barriers and treated people with dignity the terrorists would not get support the crave.
Michael FW, Porth,
The Home Office Statement reminds me of a scene in The Lord of the Rings where Gollum is talking to himself.
With his hands over his eyes he says, " Not listening, not listening, go away, I said GO AWAY!"
Phillip Jesson, Melton Mowbray,
We are supposed to be taken in by the biometric being better and safer. Yeah right and I am the King of the World. Wake up everyone and rejet this facist ideology. It is not in any interest of security. It is an invasion on our liberty.
John Finningham, Gillingham, UK
"Many of the 9/11 bombers had travelled on fake passports."
I thought they arrived in the US on genuine passports and VISAs? Are you sure about this statement???
Indeed, the FBI 'identified' the terriosts through passports found at the several of the crash sites.
Adrian Bool, Warrington, Cheshire
When I first heard the US was going to begin issuing these RFID passports I immediately got a non-chipped passport. RFID passports have no reliable, built-in security to prevent someone sitting on a bench from reading your data without you ever knowing it. No need to be in a back room...
Dave, Seattle,
It's ridiculous to say that anything is "fool proof" now-a-days. The more specific and steamlined you make these systems, the more easy they are too crack.. Our security systems need more randomization, so terrorists and other illegals do not know exactly how to prepare to get through the system.
John, NJ, USA
John@Leicester:
Sadly its not as simple as that. The blank passports will provide the necessary 'clothing' for the cloned passport. The cloned chip can be generated from remotely reading a live passport, getting valid details. Insert the new bio-metrics/picture and you've got a valid passport.
Mick, Basingstoke,
I think its very foolish to think that any chip if fool-proof. It could be hard to hack but still, everything can be hacked sooner or later. If we keep going in this direction of digitizing every database and document, my biggest fear is someone hacking it and altering our records...even government.
Ron, Ronia,
We wouldn't need such passports is the Government didn't let people in en-mass with no checks and rush to give them British Passports as part of EU strategy to erase British Identity.
We know that amongst the immigrants we have many East European Gangs and other undesirables because of this policy.
Garry, Sawansea, Great Britain
As a technologist / programmer I could have told you this. my gov like so many others seems to think that new technologies will save them from so-called 'terrorists'. Unfortunately the truth is that the so called terrorist will eventually work below the digital radar anyway.
Jason, London, UK
Seemingly Mr Van Beek created only a copy of personal data with fake certificates, keys and signatures to fool only the reader he was using. In real life if he could have been able to put the chip into a real passport control systems where data is checked against the CSCA and DS certificates he would have been arrested at the same moment.
Guy, Gent,
I guess you can download the government software of the internet. Just check the hackers sites.
If not wait for someone to leave it on the train or lose the discs again!!!
George B, London, UK
Technology will never replace common sense.
Craig, Miami, USA
So what is going to happen is that the 45 Countries using these will all be lulled into a false sense of security. The fake passport with the tampered with chip will send a fake message to the 45 Countries all saying "this person is ok" and therefore it will make all 45 Countries even more at risk.
malcolm, london, uk
In 2004 at the Defcon hacker convention at las vegas a 14 year old Boy Cracked a Biometric Identity card in 9 Mins 42 Seconds. Makes it even easyer for the Criminals but still the Government says it will stop everything, here goes billions of Tax payers Money, Chip n Pin that stopped fruad did it?.
nick walters, Corby, uk
Remember, If man can make it, make can break it. Simple as that. No matter what you try, it will be broken.
John, Toronto, Canada
I love the statement from the Home Office. They are in absolute self denial. This typifies this government complete self denial as the country continues to slide into the abyss. O dear, what a mess.
D Case, Newquay,
Well of course they could be. Did anyone expect anything engineered by this useless Government to work? They can't even arrange for our kids' test papers to be marked properly so what chance with national security?
A.M.Williams, Stafford,
Seriously, did anyone really expect these passports to be secure when the idea was first touted?
Phill, The Wirral, England
"e-passport"
They named it accordingly. "e" for easy to clone.
The only thing left in this world to be cloned is humans.
jayil, london, uk
I can't wait for this totally inept government to 'invest' over £ 20 billion of taxpayers' money in their Identity Cards system which will prove to be equally 'fakeproof'.
Is there no beginning to Labour's talent ???
Rick, London, England
I see the government has its head in the sand as usual. Still not listening.
Stephen, St. Ives, England
What bothers me is the arrogance with wich public officials went out and said: "with these new passoports security will certainly increase" when it was simply an order the white house gave to european, so-called "sovereign", countries because the yanks want to control our data and lives.
Horace, Florence, Tuscany, Italy
As Mcauley says, all of this is designed to control the activities of law-abiding people. It was never intended for serious use against gangsters and terrorists because they do not operate according recognisable rules or within enforceable regulations, and the governments know it.
bruce, St. Martin, France
The key problem is the very long lead time from concept to introduction when you are seeking international standards - what was technologically leading edge in 1999 is very old hat today. This blows any argument in support of UK ID cards out of the water.
Neil Marshall, Cambridge, UK
Only one way to make them impossible to forge, get the Royal Mint to make them.
Bill Bird, Wallasey, UK
anyone who has travelled to Israel knows that you get interviewed by two people and often get baggage and body searched if they think it's necessary. It's the only system that works. They should know.
Roz Kadir, Kingston, Surrey
As the technology to detect does progress, so will the technology to evade. There never will be a "fakeproof" passport, there are lots of inteligent people out there who will find a way to do it. After all, it was a bunch of pimple faced teens in israel a number of years ago who hacked the US DOD
Mike, Bristol,
Once again, officials who only know how to spend tax money have blown millions on a poor system, fooled by conmen; and for how many kickbacks?
Put properly trained staff on entry points, not cheap labour, from overseas.
M.Burns, Prayssac, France
Brooks, I have to disagree. More than 50% of the time the IRIS eye scanning system chooses not to recognise my eyes! I have to resort to pulling out my passport to get back into my country.
Farrukh, Woking,
I'm afraid that eyeball scanners are not safe, either.
The first thing that happened in one Japanese compnay that built one, was that an engineer used a CNC stenography machine to build up a model of his boss's eyeball by layers. This was placed on the end of a stick and used, with due ceremony.
Matthew Spencer, Bedford, England
JS Magrey - Here! here! & not just engineering either.
Scot, Glasgow, UK
i'm iust amazed that they would put their faith in and reliance on an IT system for the country's national security.
They cannot be that stupid. There must be another agenda. Same with the ID cards.
Marvo Ging, Teignmouth,
The cleverer and higher, and therefore apparently more secure, the technology level of the security system, the more dangerous it is if it is broken. Most security systems are betrayed by collaborators within. Low-tech alertness and questioning beats high-tech dumbness every time. Fund MI5/6!!!!
Paul Freeman, London, England
Well done the Times, you have shown what every professional in information technology knew could be done. Please do not let the Brown Government or Cameron's Gov't (if he becomes Prime Minister)sweep this under the carpet. 4 billion pound "white elephant".
Richard Syal, Toronto, Canada
IT Expe
Richard Syal, Toronto, canada
Why is our country run by idiots? There are plenty of intelligent people here. Why aren't they the ones in charge? Where does it all go wrong?
julian, shrewsbury,
3000 blank passports stolen?? what is the matter with the country - I can't believe how slack security is. Oh dear oh dear.
sarah, france, france
To err is human, to really foul things up requires the UK Civil Service
Peter, London,
This sounds dodgy. There is no claim that these chips can not be forged - the claim is that that if you forge them it can be detected.
British ports will have the crypto key checks .
Put your bin-laden chip through the software, check it against the public key and see if it is detected
John, Leicester, England
It can be done with the new 'Fakeproof' e-passports and it can be done with the new Chip and Pin Credit Cards. I know it can, because mine has been cloned, but the credit card company say its not possible, same as the banking industry, government, and now the home office. Nothing is impossible.
Andy, northamptonshire, uk
So the Home Office's response to this detailed factual report was to deny that it is possible! I'm reminded of the Three Wise Monkeys. There really seems to be nothing that this government cannot get deeply, seriously, irretrievably wrong. Perhaps if they had more knowledge and less arrogance...
Tom Welsh, Basingstoke,
This is not news.
At a Black Hat (hacker) meeting back in August 2006, we saw a demonstration of how exactly to clone a MRTD (machine-readable Travel Document) - VERY easy to do, public documents basically tell you how.
John Claro, Cleggan, Ireland
Earlier this year, German hackers said on telly they had cracked the chip which will be used on public transport cards in Holland. The government denied it. When researchers of the University of A'dam wanted to publish their results - that it was dead easy to hack/forge the chip - steps were taken to legally suppress their results being made public. The judge ruled in favour of publication.
It's not just the UK government being incompetent, it's far worse.
As Alan Reynolds mentions: it has now been proven by hackers, a research team - and how many more? - that cracking these chips and software is possible and not that difficult nor expensive. Hackers and researchers may be very clever - terrorists aren't stupid either.
Joe, Edinburgh: Schiphol security is a laugh and as tight as a sieve, as shown on Dutch television recently. Iris-scans are not 100% save and fingerprints can be easily forged as stated in Dutch newspapers and on telly reporting on the use of fingerprints to pay in supermarkets overhere. Also, all data stored in databases and all software can be hacked and intentionally or unintentionally altered.
By the way: this kind of chip and/or software are also used by many firms and others on f.i. personnel (security) cards - as stated in Dutch newspapers. But that cann't possibly be the case in say the UK, Germany, France, the EU...
Kate, the Hague, Holland
Yet another great IT triumph....
John, Colchester,
Home Office ' yet to see evidence of someone being able to manipulate data in an e-passport.'
If they have not been poring over the Times's evidence they are remiss. If it is misleading they need to explain why.
The Home secretary should sack the spokesman as incompetent. Then resign.
Paul Samson, St Genis-Pouilly, France
Please remind me how much the government will be charging for these new passports.
CeliaD, London,
well done the Times, good work, don't let Bruin sweep this important news under the carpet
peter c, devizes, wessex
If it's made it can be copied!
If it's stored it can stolen or lost!
If it's encrypted it can be cracked!
One set of biometrics can be replaced by another!
Sleep walking into a costly nightmare?
Jim Golightly, Prudhoe, England
'Many of the 9/11 bombers had travelled on fake passports. '
We are told that the Twin Towers were brought down by planes not bombs , however unlikely that sounds.
Ted Maul, Stockport, UK
This is a disgrace, why should so much money be wasted on something so easily broken? Furthermore, while acknowledging the excellent work done by the Times to uncover this, why hadn't the opposition parties discovered it already; this failure makes them seem as weak as the govt.
Tim, Norwich, uk
Dominic Grieve didn't call for them to be scrapped - so much for the claimed Tory opposition.
Terrorists won't arrive in the UK with passports. They will arrive as asylum-seekers without passports, then will be given amnesty and UK passports, as happens now. What security? It's a farce.
Martin, London,
Will this situation trigger a rebate for those who have been charged £66 for a new 'high tech' passport? Yet another rip off by this incompetent government!
Paul Savage, Lambourn, UK
if PKD is not used then the cards can be cloned, if PKD is used, for any participating pair of countries, then the clones dont work.
For iris scans you also need the same relationship, if the visitor is from a country that does not supply iris scans then your back to the same flaw.
memeroot, leiden,
Encryption is an mathmatical algorithm. As such unless it is particualarly strong in the case of passports you should be looking at 2048 bit keys then it is crackable, readable and unsecure. The government has a lot to learn before wasting tax payers money on failed schemes
steve tea, manchester, cheshire
When you have HNC, HND, and other diploma holders sitting next to a qualified engineers and the way they suckup to managers and bypass qualified engineers, what do you expect. Briton has destroyed engineers profession and what we have is a mess. Passport with chip is in mess. What next. ID?
JS Magrey, Warwickshire, UK
It's all major-league crap. Why do the Israelis who do a proven-fantastic job NOT depend on stupid technological crutches? Because of this! Any idiot can see that there is no magic solution here. Just interrogate everyone, and pay special attention to the 'strange' cases. It Works.
Bill Hawkins, Seattle, WA, USA
Living in Africa, the concept of security concerns being addressed in "a more public and open way" means that we would find out the identities of our politicians and civil servants who were making fortunes out of back-handers without having any investigations! Not fair - the chase is half the fun!
Alan, Johannesburg, South Africa
Surely what one man can invent, another can copy? Carrying a loose piece of paper, plastic or whatever is never going to prove that the two relate to the same identity. At Airports the IRIS system which matches the traveller's eye to the database seems more likely to be able to do this.
Alan Reynolds, CROYDON, Greater London
If the microchips are vulnerable to cloning then the original designers have completely screwed up. Sack them.
Do not attempt to patch the planned system, junk it.
Stop hiring plausible salesmen and start hiring competent engineers.
Rosemary, Germany,
These chips were never about our security, they were about keeping tabs on us. LIke Chips on bank cards, they knew in advance they could be hacked, but as it wasn't about our security anyway, didn't care. So they'll press ahead with a scheme that is now blatantly not about the purpose that was cited
George Edwards, Beijing, China
Can i just point out that even the "bad" guys have passports? i mean, they're taking on the worlds greatest military of all time. dont u think they can find transit between nations if they want? lets face it, another tax, another form of control, another hassle to deal with.
Mohamad Sharbash, London, England
This is elementary stuff for the IT industry in Asia, to get it wrong is very concerning and begs the question of how & why?
My new e-passport just cost me £160, what do you think the actual production and admin costs are? The home office appear to have created a great revenue earner that technically does not work.
Nick, Bangkok, Thailand
The only safe system at the moment is the eye scanner.
Brooks, C, Jomtien, Thailand
The more we try to use technology like this the more the criminals will find a way around it.
You could have a central database that has a photograph or fingerprint and compare directly with the digital on the passport.
Schiphol does this with retinal scans, hard to fake.
joe, Edinburgh, Scotland
from the sound of it, this is even easier than 'cloning' a driver's license or birth certificate.
so much for 'impenetrable international' security.
Lloyd, Austin,
Companies have been trying to copy protect electronic data for thirty years, they haven't succeeded and are usually broken by hackers in days. What on earth makes anyone think that the competence of this Labour government is any better? Their previous record shows they are even worse.
Fred, London,
Anything in digitised electronic media can be copied, corrupted or undermined. Large databases and large systems are especially vulnerable
Sometimes the old fashioned ink, watermark and hologram systems work better.
John Goode, Welwyn Garden City, UK
These "electronic" passports are nothing but a money-making scheme. Seems like the US-led "free world" is exploring all means of extorting money from their "citizens", a well-controlled, frightened mass, constantly watched by the (highly profitable) surveillance state and regularly milked.
Matt, Berlin, Germany
Does this mean that the only really secure method for this documentation is to check the details on the documents against a separate database, rather than containing all the data on a chip in your passport? Let them keep our details, I'd rather be safe than blown up...
Chris G, London,
More blind faith in technology by culpably ignorant civil servants and politicians. They all ought to go on a course to learn the truth about gadgets, that they all hold the seeds of their own demise. Just about any system can be hacked by a 17 year old with a lap top.
Colin, shrewsbury,
I think one of the things we should remember about these 'new' chipped passports is that they conform to rules established by airport operators. Since when did airport operators rule the world?
jeannie graham, Perugia, Italy
bio metrics, dna databases id cards and none of them are secure
at some point surely this country has to protest these things like they did the poll tax?
surely?
will, grimsby, uk
Doesn't bode well for national identity cards
Brian Putman, Oxford,
"The tests also raise serious questions about the Governments £4 billion identity card scheme"
Too right it does, but do you think for a second that Labour is going to be put off its plans to blow - yet again - billions of pounds of our money on yet another flawed IT system?
Mike, Brighton,
It only ever was there to control the law abiding population - so why is this a surprise? To let us know we only ever were just a number as far as they were concerned. You'd have to be blind and stupid to think anything else.
R McAuley, Antrim, UK