Will Biometric Passports Lead to a State of Constant Surveillance?

The biometric passport – which contains an embedded chip with personal data, facial images and fingerprints – is on its way to becoming a global travel prerequisite. Current passports will remain valid for travel to most countries until then. Germany, France and the Netherlands have already started issuing the new documents. EU parliamentarians approved the US’ demand and passed a ruling at the end of 2005 saying that its goal is to combat illegal immigration, terrorism and organized crime. But the excuse that the new passports will help prevent international terrorism is questionable since security agents will need to know whose face or fingerprints they are looking for in the first place.

Initially, Washington gave a 2006 deadline for the 27 countries in the EU and other visa-waiver countries such as Norway, Iceland and Switzerland, but then pushed the date back to June of this year to give these countries more time to prepare the technology needed to issue the biometric passports. The US State Department started introducing e-passports in 2006 and every passport holder in the US is projected to have one by 2017.

In the meantime, there is little enthusiasm for these new requirements. Data watchdogs and human rights activists argue that this regulation treats everyone as a potential criminal, thus violating the protection of citizens’ personal data and imposing a state of constant surveillance.

Peter Hustinx, the European Data Protection Supervisor, said in a press conference on the implementation of biometric passports in 2007 that security measures aimed at preventing terrorism are often stepped up at the expense of privacy. Hustinx is in charge of giving governments and EU bodies advice on data security standards and acts independently of EU institutions. He warned that the EU was “rushing in a new era” of using biometric identifiers for security checks while standards for data protection were still not clear.

“It is very important that the biometric data is only saved in the passport and not in external databanks. Until now there are no international regulations which guarantee this,” said Peter Schaar, German Federal Commissioner for Data Protection, at a conference on data protection held in March of this year in Berlin.

In 2005 when this ruling was issued, no intense political debate occurred in Germany but there were some voices of dissent. The left-wing daily newspaper Die Tageszeitung published a column saying that since 9/11 domestic security had gained more importance than the protection of fundamental citizen rights. In addition, security experts have warned of the danger and ease with which hackers and state agencies could abuse the data registers and the sensitive personal information they track.

In fact, the e-pass, which is supposed to protect states against terrorist attacks, is not so safe at all. In 2006 at the Black Hat security conference held in Las Vegas, Lukas Grunwald, a German computer security consultant, proved that the data in the chips is easy to copy. He demonstrated that a terrorist could carry a passport with his/her real name and photo printed on the pages, but with a chip that contains different information cloned from someone else’s passport. However, this could be easily avoided if the security official examines the pass to make sure the name and the picture printed on it match the data read from the chip.