Security concerns over U.S. decision to outsource e-passport production

designed to foil counterfeiting, GPO led the work of contracting with vendors to install the technology. Each new e-passport contains a small computer chip inside the back cover that contains the passport number along with the photo and other personal data of the holder. The data is secured and is transmitted through a tiny wire antenna when it is scanned electronically by RFID readers at border entry points and compared to the actual traveler carrying it. ertz says that interviews and documents show that GPO managers rejected limiting the contracts to U.S.-made computer chip makers and instead sought suppliers from several countries, including Israel, Germany, and the Netherlands. Somerset, the GPO spokesman, said foreign suppliers were picked because “no domestic company produced those parts” when the e-passport production began a few years ago.

The chain of e-passport production looks like this: The computer chips are inserted into the back cover of the passports by a European manufacturer; after the chips are embedded in the cover, the blank covers are shipped to a factory in Ayutthaya, Thailand, north of Bangkok, to be fitted with an RFID antenna. The blank passports are then transported to Washington for final binding, according to the documents and interviews. Now, it is the stop in Thailand which raises security concerns. The country has experienced social instability and is battling Islamic terrorism in the southern part of the country. The country is also regarded as one of the most corrupt countries in the world. The company which assembles the U.S. e-passport covers in Thailand is the Netherlands-based Smartrac Technology. In an October 2007 court filing in The Hague Smartrac charged that China had stolen its patented technology for e-passport chips, raising additional questions about the security of America’s e-passports (on China’s massive industrial espionage campaign against Western companies, see HSDW stories from 12 November 2007, 16 November 2007, and 3 December 2007).

Security experts are worried. “The most dangerous passports, and the ones we have to be most concerned about, are stolen blank passports,” said Ronald Noble, secretary general of Interpol, the Lyon, France-based international police organization. “They are the most dangerous because they are the most difficult to detect.” Noble said no counterfeit e-passports have been found yet, but the potential is “a great weakness and an area that world governments are not paying enough attention to.” Lukas Grunwald, a computer security expert, said U.S. e-passports, like their European counterparts, are vulnerable to copying and that their shipment overseas during production increases the risks. “You need a blank passport and a chip and once you do that, you can do anything, you can make a fake passport, you can change the data,” he said.