USA The government is known for taking a “better late than never” approach to its technology deployment. Continuing that tradition, U.S. Customs and Border Protection (CBP) today confirmed that after 16 years, it has finally implemented Software upgrade required to verify cryptographic signatures stored in passport RFID chip.
Since 2006, the United States and many other countries have embedded these small chips in the back of their passports, otherwise known as “Electronic Passports” as they are known. This chip digitally stores the document owner’s personally identifiable information, including your name, date of birth, passport number, and biometric data such as your photo, along with a cryptographic signature used to check against tampering or tampering. For many years, the United States has required Visa Waiver countries to issue e-Passports to their citizens who wish to enter the United States. During this time, however, CBP did not actually implement software to perform these validation checks.
In early 2018, US senator Ron Wyden of Oregon and former senator Claire McCaskill of Missouri wrote a letter to CBP calling on the agency to implement cryptographic verification, because of the Electronic Passport infrastructure RFID element has been in operation for many years. Last week, five years after that request, CBP notified Wyden’s office that it had established and operated an electronic Passport verification system as of June 2022.
CBP says the verification process has so far examined more than 3 million passports from Visa Waiver travelers and has “contributed” to the arrest of 12 people accused of attempting to enter the United States by means of a visa. identity documents “fraudulent”.
“During primary processing, the E-Passport technology warned on the documents and the traveler was transferred to a secondary location, where CBP officers determined that the traveler was in possession of the travel documents. fraud schedule,” the agency said in a statement.
“Upgrading passport security is a sensible way to make sure people entering our country do what they say they are. It has made America safer without resorting to invasive searches or huge databases of personal data,” Wyden said in a statement to WIRED. “I commend CBP for complying and ensuring that counterfeiters and criminals cannot use fraudulent passports to bypass security at the border.”
Although the verification process has been ongoing since June, CBP said it was still unable to verify the e-Passport issued by Andorra, a small country located between Spain and France with a population of less than 80,000. However, in addition, CBP is conducting authentication checks for all Visa Waiver countries.
“This is a huge investment by the United States, so I am pleased to see that they are using these capabilities and that they work the way they are supposed to,” said Matthew Green, a cryptographer at the University of California, Los Angeles. Johns Hopkins said. “This system is really just a basic check to help catch people traveling with fake documents, which is what we want to do. And it’s not nearly as intrusive as facial recognition or other systems being deployed at the border, so overall, it looks like a good system to work with.”
Office of Government Accountability 2010 report sets the case for rapid implementation of signature verification for e-Passports. The GAO wrote at the time that the U.S. Department of Homeland Security (DHS) “is not capable of fully verifying digital signatures because it… has not implemented the necessary system functionality to perform verification.” “Additional security against forgery and counterfeiting that can be provided by including a computer chip in electronic passports issued by the United States and abroad… has not been fully implemented.”
More than a decade and a half later, e-Passport digital signature verification is finally something DHS can tick off its to-do list.
