Passport Information Safety

In our previous article we talked about general characteristics of passports, but we only scratched the surface of this complex travel document. Why are we hearing more and more about biometric passport technology and why is it important? How is information stored in your passport and is it safe? Let’s open your passport pages once again and take a closer look.

Before we list different types of passports, their security mechanisms and other relevant aspects, it should be noted that there is something all passports have in common – the so-called data page. A data page is most commonly one of the initial pages in a passport and it contains basic information about its owner, such as his/her photo, name and surname, address, expiration date and passport number. The basic set of personal data is mandatory and standardised, though some passports contain its owner’s height and some additional data on the owner’s physical traits. Together with this data, on the data page, there is a Machine Readable Zone (MRZ), where the data is embedded in a way that only a machine can read it. When crossing borders, the data is read by laying the data page against a passport scanner that can read the information from the MRZ.

Technologically speaking, there are several generations of passports, but one of the primary differences is the chip.

If your passport doesn’t contain a chip, the only way for a machine to communicate with your passport is through the MRZ which is located on your passport’s data page. Firstly, it is important to open the passport and place it on the scanner, which then directs a special light to the MRZ, after which it can read the basic data about the passport holder. The data presented visually at the data page of your passport is located in the MRZ, hence the machine can read the same set of information as much as a person holding the passport.

Passports containing a chip are more up-to-date, reliable and virtually impossible to be forged. All of the data from your data page is also stored in the chip, which makes identity theft and personal data forging far more difficult. Apart from this data, the chip contains biometric data, such as your photo (both black-and-white and in colour) and, depending on the country where it was issued, it can contain finger prints or the owner’s pupil scan. We will write more about biometric data, its protection and access control in our next article!

The chip in the passport is most commonly submerged in the polycarbonate data page and it is contactless, which means that the communication is done through RFID waves, so there is no need for physical contact between the chip and the passport scanner for them to communicate electronically.

Data access control in the chip is in your hands

Of course, we are now all thinking about the safety of the data on the chip, considering that the chip can be read in a contact-free manner. We’re sure that quite a few of you are now thinking about the mechanisms that guarantee data safety and how to prevent an unauthorised person from reading the data from your chip by using a data transceiver while you’re going towards your boarding gate or enjoying a cup of coffee before your flight.

“A passport is designed in a way that data access is allowed solely to the persons whom you’ve explicitly authorised, all in order to protect the safety of your data.”

The chip is protected from unauthorised access and cannot be accessed without an appropriate key – but how is it accessed then and what is that key?

The key itself is a certain derivate made from the data located on the data page in the passport. When you want to allow the passport to be scanned, you open the pages of the passport and place it on a scanner that, as we mentioned before, scans the passport owner’s data from the MRZ. However, the data scanning process does not end there, quite the contrary. The scanned information from the MRZ is used to form a particular key that unlocks access to the passport chip, i.e. if the scanner has access to the data in your MRZ, only then can it access your data in the chip as well.

In order for the system to access the data in you passport’s chip, it firstly needs to access your data page which is secured by your cover pages. By opening those cover pages and placing the passport on the scanner, you allow the scanner to read the MRZ and the data from your passport’s chip. The chip will share the information only if it recognises the access key and the key itself is generated from the data located on your data page.

The overall mechanism described in this text refers to textual data protection and photos of the face located in the chip. In our next article, you can find out more about advanced security systems used for additional protection of access to sensitive data (such as fingerprints).