Your Passport's Complex Security Tech, Explained By Forgery Pros
The passport is a bizarre and unique object. Think about it: The goal is to put it in the hands of millions upon millions of people—and for none of them to ever understand the technology that's at work in their wallets.
It's an extremely important mystery: Passports protect our identities, they protect national security, they are the best proof of ID we have. These days, it's actually incredibly difficult to counterfeit security elements in passports. It's much more common to see passport fraud committed with real passports, not forged ones. Still, the huge black market for passports has inspired very smart, very capable people to go to great lengths to fake them.
US passports are printed at the US Government Printing Office using 60 different materials. All in all, there are as many as 30 security features at work in that piece of plastic and paper—and most of them aren't even visible to the holder.
While our passports are ubiquitous objects, the specifics of the assembly process is still top-secret protected information. When I contacted Homeland Security for this article I was told that the forensic lab's experts couldn't discuss the security "in the specificity I'd be interested in." Even online, it's difficult to find out specifics about the technology inside our passports. So I asked a few passport and forgery experts to tell me more.
Holograms: The Hidden Cost of Complexity
Obviously, you want to know about the holograms first, because holograms.
Even though they were invented in the late 1940s, holograms have only been a part of passport security for a few decades, as Tom Topol, a passport historian and collector, recently told me. Topol says the UN was the first issuer to put one on its passports in 1984, and countries quickly followed. Today, there's probably a see-through hologram covering your "biodata" page—where your biographical data is stored—but that came even later, in the 1990s.
There are dozens of types of holograms, and often, the technique used on banknotes or passports are proprietary to a particular company. For example, a company called Kinegram developed a unique hologram that it applies as strips or stamps to documents, like this banknote.
That said, some holograms can be forged—or at least closely recreated—using a number of techniques, the simplest of which uses a piece of metal pressed onto the hologram and then using that piece as a die to cast new holograms.
I had a fascinating conversation with Tony Sales, a self-described reformed fraudster in the UK who allegedly stole millions of dollars over the course of just a few years thanks in part to his skills with fraud and forgery, who confirmed that with enough time, you can learn (or buy) nearly anything.
"The first machine I ever saw was a holographic stamper, it just punched a hologram into the actual item; it wasn't complicated at all," says Sales of his early days forging documents including passports (he's often described in the media as "Britain's greatest fraudster"). Since then, he's turned his skill set into a career helping companies prevent fraud and theft—working with companies to develop better EAS tags, for example, and helping security experts understand how criminals might attack a particular defense using fraud.
How hard is it to get ahold of a machine that can stamp holograms? According to Sales, it's gotten more difficult since he was working. "Checks are done a lot more thoroughly on companies that want to obtain that kind of equipment," he says. But it's not impossible to obtain these machines. "They can just open up a shell company and as long as they're willing to confirm that they're the company, nine times out of ten it'll get shipped," says Sales.
Still, holograms seem like an increasingly difficult element to forge as technology improves. They're often layered with other security elements like specialty inks or fine line engraving. One major improvement over the past decade is the transparent hologram that's overlaid on your biodata page:
Wikimedia/CC.
At the same time, one major weakness of holograms on IDs is the fact that as they get harder and harder to copy, they also get more complex—and all those details can be too much for a security agent to even remember. "The danger is that the OVD [Optical Visual Device] itself becomes so complex that it is impossible for an inspector to remember all the features that distinguish the genuine article," explained Robert Smith in the Keesing Journal of Documents & Identity in 2011. "Many simulations look good enough to pass visual inspection even if they contain inaccuracies that would rapidly be detected upon level two or three inspection."
Complexity, even though it's tougher to copy, isn't always good for security.
Ink You Never See and Paper That Hides Secrets
Inks are another key element of passport security—you might have never noticed these minute details, but the chemical makeup of ink, thread, and paper are all key features. "Most advanced security features are unknown by the bearer of a passport," Topol says.
There are thermochromatic inks that change color when heated or cooled; inks that dissolve when they're tampered with; inks that are one color from one angle and another color from a different vantage; and UV inks that appear or disappear under a UV light—many passports, including Canada's new design, have a "hidden" design only visible under a UV light.
Wilson Hui/CC
There are dozens of unique printing techniques used to make passports around the world. The USA on the corner of your biodata page, for example, is printed with an optically variable security ink—so it looks green in one light and gold in another, as the State Department explains on its website. The paper might include florescent particles that react to UV light, as you can see in a close-up of a UK passport below, or the thread itself might include unique fibers.
Sometimes, it's not ink at all. The cover of your passport is made from plastic, plain and simple. The elaborate seals that are specific to your country of origin are applied through a common process called hot foil stamping—it's used on everything from fancy candy packaging to luxury handbags. Rather than applying regular ink with a stamp, as you might with a letterpress, the printer uses a piece of foil to stamp into the plastic, then peels the excess foil away.
Does that mean that these printing techniques are easy to reproduce? Not necessarily. "A lot of the forgers in the early days would have had a printing background, so they'd be aware of it," says Sales. It's all about research—and even then, it can be difficult to gain access to specialized knowledge.
Printing & Type: Still the Hardest Part to Fake
More than anything else, passport security is about printing. That sounds boring; it's not.
Security printing is fascinating, combining techniques that date back to the early Medieval age like intaglio printing, where those complex, twisting patterns you find on your passport pages are engraved on a steel plate and then the paper is laid over the inked plate to create a print.
Other printing techniques come from the cutting edge of the printing industry. Some of the printing on your passport is invisible without a magnifying glass—microprinting—or even a microscope—nanoprinting. Thanks to super-high-res printing techniques, some patterns and text can get down to one micron, according to Smith's article from 2011. "This far exceeds the resolution available via any other copying, printing or scanning device in the printing industry, and cannot be replicated by forgers," he writes.
Tiny details of the type can be a key way to spot fraud, too. An errant line or bump in a word could help investigators determine whether a passport is legit. As Gizmodo's Jesus Diaz recently pointed out, security printing on dollars has increased in resolution to the point where under a microscope, tiny details of the print are highly raised and visible.
So in a way, the most banal part of your passport—the printing—is actually one of the strongest.
I asked Sales what the most difficult element to forge on a passport was, and his answer surprised me. It wasn't thermochromatic ink or RFID chips or specialized holograms. It was something super simple: The typeface.
"No one ever gets the exact font," he says, explaining that under a microscope, tiny inconsistencies are incredibly difficult to replicate. In fact, some typefaces used by the government have deliberate, minute imperfections—like ink bleeds—that make them harder to digitally re-draw. Copying a country's font would mean actually getting ahold of a copy of the typeface. "Then we're talking industrial espionage, where people are stealing fonts for computers, and that becomes something totally different," he says.
The Verdict Is Still Out on Machines and Chips
The most controversial aspect of modern passport design, of course, is the electronic chip nestled in the upper lefthand corner of the back page of your passport book (this State Department podcast is a great source for more about how they're manufactured). This RFID chip usually contains information like your name, your photo, and other details, and in the US, the State Department programs and locks them at the Government Printing Office in DC to ensure they're secure.
That said, the security of RFID chips and other machine-readable elements of the passport have been questioned again and again since their introduction. In 2006, a security researcher named Lukas Grunwald demonstrated to Wired's Kim Zetter—and later at BlackHat—that he could clone the chip and rewrite the new version with software that could crash or override the machines used to check the chips.
That said, the security of RFID chips and other machine-readable elements of the passport have been questioned again and again since their introduction. In 2006, a security researcher named Lukas Grunwald demonstrated to Wired's Kim Zetter—and later at BlackHat—that he could clone the chip and rewrite the new version with software that could crash or override the machines used to check the chips.
Given that almost a decade has passed since his demonstration, I asked Grunwald whether anything has changed, and he pointed out that Germany has since changed the passport number to include characters, which is an improvement. But in the end, it's still quite easy to learn how to carry out the same process online. "There [are] right now several open source projects out that would do," said Grunwald over email. "Many of them works with normal JCOP (JavaCard) Smartcards available on the internet."
This Is a Race That Will Never End
The sense I got was that this is an eternally tied race: As security technology has improved, so have counterfeiters, spurring more changes on the state side of things, and so on. The internet, and the dark web, have made it even easier to buy and sell the technology needed to manufacture a passable passport. "We live in a digital age where information is easily obtained," says Sales. "I'm sure I've looked on the dark web before and all of the information and places to buy these machines, are for sale for anyone who wants to chance their luck at it."
Moreover, passports are products of globalization, just like almost everything else we own. A recent audit by the Government Printing Office investigated the supply chain found that the US passport is made from 60 different commercial materials, supplied by 16 different contractors—six of which are sub-contractors that the office has zero relationship with. These materials are assembled in countries all over the world, by contractors specializing in everything from fluorescing thread to specialized holograms to.
That's not to say our passports aren't secure—these are some of the most advanced document security techniques in the world. But rather, the process of keeping them secure is one that will never be perfect. As I heard again and again, there's no magical high-tech solution that will end this race—a combination of emerging and tried-and-true security features works the best. It's an iterative process, like so much design work, that will need constant updating and improvements every year.
Next time you pack your passport for a trip, take a second to appreciate just how contentious that little piece of plastic and fiber and metal really is. You'll probably have one for the rest of your life, but within that time, the technology inside it will have evolved dozens of times.
No comments:
Post a Comment
Please leave a comment-- or suggestions, particularly of topics and places you'd like to see covered