BIOMETRICS: EU ON PARALLEL TRACK WITH U.S. AND

C O N F I D E N T I A L SECTION 01 OF 08 BRUSSELS 004844

SIPDIS

CA FOR FMOSS AND JJACOBS; EUR/ERA FOR KSHEARER; DOJ FOR
CRIMINAL DIVISION - BSWARTZ; DHS FOR SBOYLAN, BTS - MCLAYTON

E.O. 12958: DECL: 11/10/2014
TAGS: CMGT SMIG PTER PREL CPAS CVIS EUN USEU BRUSSELS
SUBJECT: BIOMETRICS: EU ON PARALLEL TRACK WITH U.S. AND
MOVING FORWARD

REF: (A) 03 BRUSSELS 4747 (NOTAL) (B) BRUSSELS 0928
(NOTAL)

Classified By: PRMOFF MARC J. MEZNAR. REASONS 1.4(B) AND (D).


1. (U) Summary. In parallel with U.S. efforts to incorporate
the use of biometric identifiers, the EU is finalizing plans
to enhance its border controls through the use of biometrics.
On October 26, EU Justice and Interior Ministers agreed to
incorporate two biometrics into national passports, thus
surpassing the ICAO recommendation and U.S. plans for its own
passports. If the three Member States which have expressed a
reservation about this decision give it the green light, EU
Member States will have until mid-July 2006 to begin issuing
passports with digitized photographs and until the end of
2007 to add digital fingerprints to the chips. The EU may
decide to restrict international access to some of the
biometric data, particularly the passport fingerprints. By
the end of 2007, the EU hopes that its 3500 consular posts
and all its international ports of entry will be connected
through the Visa Information System, and name checks against
the EU lookout system will be automatic. Given the
technological challenges, implementation of these plans may
slide. Switzerland has been given the green light to align
itself with the EU's visa and passport policies. The EU is
also considering enhanced consular cooperation abroad as it
moves to biometric visas. End Summary.

--------------
Overview
--------------


2. (SBU) The EU and the U.S. have been working together in a
variety of international fora (such as ICAO and the G8),as
well as bilaterally, to combat terrorism and illegal
immigration through the use of biometrics. Close cooperation
between these key players is essential to ensure worldwide
interoperability. The terrorist attacks of 9/11 in the U.S.
and 3/11 in Spain were catalysts for countries on both sides
of the Atlantic to expedite their plans for securing travel
documents and strengthening border controls.


3. (SBU) On parallel tracks, both the U.S. and EU are
incorporating biometrics into their consular and border
management systems to cut down on visa fraud, asylum fraud,
visa over-stayers and the use of stolen documents by
imposters. The European Commission (EC) has proposed using
biometrics in the following critical areas: visas and
residency cards, lookout systems and national passports.
While the EU is strongly committed to establishing a closer
link between the applicant and the travel document through
the use of biometrics, Member States will not fully avail
themselves of biometrics to check applicants against existing
EU lookout databases. Critics have questioned the need for
biometrics, citing privacy concerns and financial costs.
Nevertheless, political agreement to go forward with
biometrics has already been achieved; technical standards
should be finalized in early 2005.


4. (U) Because of "opt-outs", these requirements do not
automatically extend to the UK, Ireland and Denmark.
However, the three countries are expected to "opt in" or
adopt similar provisions in parallel with the rest of the
union. EU decisions on biometrics will automatically apply
to Iceland and Norway because of their participation in the
Schengen Agreement. Furthermore, on October 26 the
Government of Switzerland signed an association agreement on
to bring the country into the Schengen area. While
ratification of the agreement remains pending (possibly by
referendum),Switzerland "will be involved in all discussion
taking place in the Council as far as the further development
of the Schengen acquis is concerned."

--------------
Schengen Visas
--------------


5. (U) As reported in reftel a, the EU decided to expedite
the incorporation of biometrics into some of its travel
documents following the terrorist attacks of 3/11 in Spain.
The date for including digitized photographs into visas and
residency permits was moved up to 2005 (from 2007).


6. (C) Discussions are still taking place in the EU's "visa
working group" regarding the technical standards related to
biometrics in visas. Most Member States have expressed an
interest in a flat scan of all ten fingerprints of each visa
applicant. According to Silvia Kolligs, the DG Justice and
Home Affairs (JHA) policy officer who is drafting the
biometrics proposals, the EC will only require that the two
index finger scans be included in the biometric visa. The
other eight, if taken, would be stored by the Member States
and used for national purposes or to mitigate "false hits" at
ports of entry.


7. (C) Last month, the Article 6 subcommittee re-examined the
EC's proposal to incorporate these two biometrics on a "radio
frequency identification chip" (RFIC) embedded in the visa
foil. According the Head of Unit for Large Scale IT Systems
at DG JHA Frank Paul, the EC is backing away from this method
for four reasons. First, the more chips being sandwiched
into a passport, the more likely it will be for "collision"
to occur from the various chips emitting radio signals.
Second, privacy advocates who favored a system where the
citizen alone has physical custody of the biometric chip and
its data (instead of depositing the data into a central
database) are increasingly concerned about privacy breaches
caused by chips emitting data. Third, the U.S. experience
has shown that the "response time" of querying a centralized
system is minimal and will not seriously affect the workflow
(either at consulates or ports of entry). Fourth, the U.S.
system of sending biometrics electronically to a central
database is much cheaper than procuring chips.


8. (C) As an alternate to chips being embedded in the visa
foil, the EC is examining two possibilities. The first,
strongly supported by Germany and France, would be an interim
solution with a separate plastic card containing the
biometric chip being issued to the applicant at the same time
the visa foil is placed in the passport. The second option
would be to copy the U.S. model and have all the data stored
in a centralized system. This, however, would push the
biometric visa to 2007 when the Visa Information System (VIS)
is operational (more information below). Most states arguing
against the interim solution of a separate card do so for
financial reasons. The supporters of the plan, besides being
eager to move forward with biometrics, point out that the
separate card format can be used for longer-term residency
cards. (Currently, Member States have the option for
long-term residency documents to be either in foil or card
format.)


9. (C) If the deadline for incorporating biometrics into
visas is pushed to 2007, the EC will still begin issuing
Schengen visas in 2005 with scanned photographs on the foils.
Although capturing an image from a photograph attached to
the visa application is good enough to print images on foils,
Kolligs said that once biometrics are fully implemented with
the option of running facial recognition checks, live
photographs will probably have to be taken at the time of the
visa applications.


10. (C) Another technical issue under discussion relates to
security standards for collecting the biometric fingerprints
of visa applicants. Because a decision to require consular
officers to personally collect each scan would lead to
serious workflow problems and require applicants to travel
far distances in many instances, the EC is considering
alternative methods (like certifying travel agencies).
Ensuring security without disrupting legitimate travel will
be key in this decision. According to Kolligs, she does not
see any realistic alternative other than copying the U.S.
model and requiring all visa applicants to apply in person
for a visa.


11. (SBU) The EU will also reconsider the price of its
Schengen visas, given the cost of incorporating new
technologies. Under current policies, the uniform price for
a Schengen visa is 35 euros. Member States are free to waive
fees (for humanitarian or other reasons),but may not charge
more.


12. (C) All of the above changes will be discussed at the
next visa working group, November 16-17. Decisions will be
sent up the chain of command (SCIFA and COREPER) to the JHA
Ministers for a final decision in early December. Then,
Kolligs will revise the various EC proposals and amend the
Common Consular Instruction to reflect the requirement to
take fingerprints, etc. She estimates that final versions
will be finalized by January 2005.
--------------
Visa Information System
--------------


13. (SBU) The biometric visa will be the fundamental unit of
the EU,s Visa Information System (VIS),currently in the
last phases of discussion. Once fully operational, the VIS
will tie together all 3500 visa issuing posts of the 25
Member States abroad and all the EU's international ports of
entry, as well as those of the three associated countries.
The system will be the largest in the world, handling
approximately 20 million visa applications per year. The EC
expects that the central component of the VIS system will be
operational by the end of 2006 using alphanumeric data and
that the biometric components will be quickly integrated in

2007. While the EC develops the central system, Member
States must build their own national visa systems than can
support a biometric component. Each of the national systems
will connect via an "interface" with the central database
managed by the EC.


14. (SBU) Member States will gradually roll out (at their own
expense and effort) the equipment to scan fingerprints at
their consulates and their international ports of entry.
Among those cited by the EC as potential "first wave"
participants in the VIS, beginning in 2007, are France,
Germany, Italy, Poland, the Czech Republic, Hungary and
Slovenia. Visa holders will have their fingerprints verified
at ports of entry by scanning one or two of their prints
(similar to US VISIT, although without the check against
criminal databases).


15. (U) The EC proposal includes the following advantages of
an EU-wide visa system:
-- boost anti-fraud efforts by improving exchanges of
information between Member States regarding information
contained in visa applications;
-- prevent "visa shopping";
-- facilitate communications between consular posts and
European ports of entry, as well as between consulates abroad
and consular headquarters in European capitals;
-- verify the identity of visa holders at external borders,
immigration posts or police checkpoints;
-- verify the identity of visa over-stayers and assist in
their removal if undocumented;
-- help determine the state responsible for adjudicating an
asylum application (if the asylum seeker had been issued a
visa); and,
-- contribute toward improving the administration of a common
visa policy to improve internal security and combat terrorism.


16. (SBU) Once the VIS is operational, a person who is caught
illegally in the Schengen area and claims to have no
identification can have his or her biometric fingerprint run
against the VIS to establish identity and nationality. If
the individual makes an asylum claim, a check against the VIS
can also be made to determine responsibility for adjudicating
the claim (i.e., the country that issued the visa). The VIS
cannot, however, be used for investigative or law enforcement
purposes. (Example. A fingerprint found at the scene of a
crime could not be run against the VIS to see if by chance
there were a match.) Approximately 25 percent of EU visa
requests are refused.


17. (SBU) Under EU data retention rules, information in the
VIS will be kept five years after the expiration of the visa.
In exceptional circumstances, the information can be kept up
to ten years. If an alien becomes a citizen, personal data
must be removed from the VIS. After the data is removed, it
is kept for an additional year in a "locked file" that can
only be accessed if fraud is suspected. Given these
parameters, the EC estimates that at once fully operational,
the VIS will have data on over 70 million applicants in the
system. Electronic files would include a digitized
photograph, fingerprints and scanned documents to support the
visa application.

--------------
Name Checks at the European Level
--------------

18. (SBU) The VIS will share a common structural platform
with the EU's lookout database, the upgraded Schengen
Information System (SIS2),but will retain separate
operational controls. Visa applications will be
automatically checked against the SIS2 to determine whether
the individual is prohibited from entering the Schengen area
(the so-called Article 96 list). Under the current system,
visa posts must perform manual checks against the SIS. Most
countries use compact discs sent through diplomatic pouches
for the mandatory name check. Under this system, the lookout
information is dated, and there is no certainty that a name
check has actually been run. In contrast, the VIS check
against the SIS2 will be automatic, instantaneous and an
integral part of the visa issuance process.


19. (SBU) According to standard EU procedures, if there is a
hit against an individual in the SIS, the visa is usually
denied without further questioning. The adjudicating officer
has the ability to ask the country that entered the name onto
the Article 96 list for additional information. (Language
difficulties and time lapses frequently discourage requests
for additional information by the interviewing officer.) A
consular officer has the option to issue a
geographically-limited visa to an applicant placed on the
Article 96 list by another EU Member State. A geographically
limited visa, in theory, does not permit free circulation to
other Member States (although lack of internal border
controls means there is no physical barrier to prevent
circulation).


20. (SBU) Although both the VIS and SIS2 will both contain
biometrics, the EU is not currently considering biometric
checks against any SIS2 files such as law enforcement
databases (fugitives from justice, suspected criminals, etc.)
or judicial databases (those wanted for extradition or to
appear in court as witnesses). At the European level, the
SIS2 biometric function will only be used to confirm identity
in the case of an alphanumeric hit on the system,s Article
96 list and used for border management purposes.


21. (SBU) The SIS2 is programmed to be operational by March

2007. This is a key date, not only for the VIS, but also for
the new EU Member States. Border controls between the old
and the new Member States cannot be removed until the new EU
countries have access to the SIS2. (The EC must also certify
that external borders and other technical standards are up to
Schengen requirements before internal borders fall.)

--------------
Additional Name Checks at the National Level
--------------


22. (SBU) In addition to the EU-wide SIS checks, Member
States can -- and often do -- run name checks against their
own national lookout systems. These systems frequently
contain derogatory information not entered into the SIS,
including intelligence and other sensitive information
countries are not willing to share with other Member States.
Any fingerprints collected as part of the visa application
could also be run against a Member State's criminal database.


23. (SBU) Another method to restrict visa issuance apart from
the Article 96 list relates to the so-called "VISION"
consultation network. VISION lists nationalities (not
specific names) which require prior notification to certain
interested countries before Schengen visas can be issued by
consular officers of other EU Member States. Although the
list is classified, VISION lists generally follow colonial
patterns. For instance, before any Member State issues a
visa to an Algerian citizen, France must be given the name of
the applicant. Even though the applicant might not be on the
Article 96 list, France can refuse to allow the partner
Member State to issue the visa. Because of magnet
communities and language ties, citizens of former colonies
are thought to be more likely to eventually end up in the
territory of the former colonial power. The VISION list can
also help to combat both the movement of suspected
terrorists.

--------------
Tenders and Contracts
--------------

24. (SBU) On October 26, the EC signed its first contract for
the VIS and SIS2, awarding the 40 million euro project to a
multinational team of IT companies led by STERIA-France and
HP-Belgium. This project will allow a preliminary version of
both systems to go forward with capabilities for alphanumeric
data and digitized photographs. Tenders for a much larger
contract (up to 400 million euros) will be issued in 2005.
The second phase will permit the two systems to incorporate
digital fingerprints, as well as scans of documents that
support the visa applications.


25. (SBU) Note. Frank Paul plans to travel to the U.S. on
his IVP program in early 2005 to consult with policymakers
and technical specialists as the EC begins implementing the
decisions made regarding biometrics. While there, he also
hopes to meet with U.S. companies that supply biometric
technologies. The EC has been very happy with the products
supplied by U.S. firm Cogent to EURODAC, the EU,s
biometric-based system for asylum seekers. End note.

--------------
Passports
--------------


26. (C) On October 26, JHA Ministers decided to require two
biometrics in national passports: a digitized photograph and
digital fingerprints. Their decision significantly altered
the original EC proposal, which called for just digitized
photographs. Among those countries pressing hardest for the
double biometric were France, Germany, Greece, Italy,
Lithuania, Malta, Poland, Slovenia, and Spain. Those most
skeptical were Estonia, Finland, Latvia and Sweden, while
those expressing reservations over the cost were Denmark and
Portugal. At the JHA meeting, both Finland and Austria
placed "scrutiny reservations" on the decision, meaning they
wish to examine the issue more closely. (Note. During a
meeting on November 4 in Vienna with an Austrian official in
charge of biometrics, he told PRMOff that Austria was
concerned over the price of this endeavor. According to
Kolligs, Austria also questions the need for fingerprints in
passports. End Note.) The Netherlands also has a
reservation until its national parliament can review the
decision. Any of these countries could render a negative
decision and scuttle the process, although the likelihood of
this is very small.


27. (SBU) Another change from the original proposal allows
for a longer implementation phase: 18 months (instead of 12)
for the digital photographs and 36 months for the digital
fingerprints. The 18-month implementation phase would give
EU countries until mid-2006 to issue biometric passports (far
past the USG's current October 26, 2005 deadline for visa
waiver countries). Passports in circulation at the time the
deadlines kick in will remain valid. Several smaller EU
Member States -- such as Belgium, Austria and Slovenia --
should be able to meet the USG deadline. During a
ministerial meeting on June 8, Germany and Denmark publicly
stated they planned to begin issuing biometric passports with
digitized photographs before the end of 2005 partly because
of the U.S. visa waiver legislation. At a CIREFI meeting on
October 29, Italy committed itself to the same implementation
timeline.


28. (C) The EC is now working to spell out the technical
standards for the biometric passports. Important questions
related to data protection and data privacy include: 1) what
information is stored; 2) how can it be used; and, 3) who has
access to it. According to Kolligs, the EU will probably
determine two levels when restricting access to the chip.
For the biographic data and photograph, the EU is considering
"basic access" control, requiring that the passport's
machine-readable zone be swiped before the chip can be read.
This procedure would reduce concerns of privacy advocates who
fear that a chip which continually emits data could be read
by a curious bystander using basic equipment. For the
sensitive fingerprint data, which will not be displayed on
the passport's photo page, the EU is considering "extended
access" or "key code" controls. Once the passport is swiped,
the reader will recognize the user's authority to view the
fingerprint and the user will be asked to enter a key code to
view the fingerprint.


29. (C) It will be up to the Member States to decide on a
broader range of technical issues related to passports,
including how many fingerprints to scan. The EC envisions
requiring two index fingers (with a descending priority of
other fingers if those two are missing). However, Member
States could require their citizens to have all ten
fingerprints scanned. They will also be responsible for
determining where and how the prints are taken and to which
other national authorities (including the U.S.) they might
grant "extended access" to view the fingerprints inscribed on
the chips. It will also be up to Member States to decide
whether to run the fingerprints of applicants against lookout
databases before issuing the passport. According to Kolligs,
Germany is the driving force behind fingerprints in
passports; she said that other countries such as Spain and
Portugal, which have routinely fingerprinted their nationals,
are also supportive.

--------------
Towards an EU Consular Service?
--------------


30. (U) Given the developments related to passports and
visas, some Europeans question whether it remains practical
for each Member State to maintain a fully operating consular
section in major cities. Already, EU citizens abroad can go
into other EU Member State consulates for assistance if their
own government is not represented locally. Consular officers
can issue temporary EU travel documents to citizens of other
EU countries for emergency onward travel.


31. (SBU) With the development of the VIS, further
cooperation or consolidation may occur. Two scenarios have
been proposed to streamline visa issuance procedures. The
basic version envisions a visa processing center jointly
shared by the Member States represented in that city.
Employees would do all the pre-processing (i.e., collection
of the fingerprints and fees, name checks, etc.) and then
send the applications to the appropriate consulate for
adjudication. An enhanced variation provides for the visa
officers of the various countries being co-located in these
centers and adjudicating there as well. This would
undoubtedly result in closer cooperation and further reduce
visa shopping. However, it might restrict access to national
lookout databases.


32. (U) In its proposal for JHA goals over the next five
years (known as "Tampere II" or "The Hague Program"),the
Dutch Presidency states the need for "further harmonization
of national legislation and handling practices at local
consular missions. Common visa offices should be established
in the long term, taking into account discussions on the
establishment of a European External Action Service." The
Dutch Presidency also welcomed some initiatives by individual
Member States, on a voluntary basis, in pooling their staffs
and resources to issue visas.

--------------
EU Time Line: Next Steps
--------------


33. (SBU) Important dates in the EU decision-making and
implementation process are as follows:

-- February 18, 2004: The EC put forth its proposal for
biometrics in EU passports. Commissioner Vitorino briefed
the JHA Council and said the proposal was not intended to
harmonize passports: "We are just dealing with basic security
features." Though the introduction of fingerprints should be
considered optional for the time being, it could become
mandatory in the future," he said.

-- June 8, 2004: The JHA Council agreed to include one
biometric in EU passports (digitized photographs).

-- October 26, 2004: The JHA Council agreed to include a
mandatory second biometric in EU passports (digitized
fingerprints). Switzerland signed an agreement with the EU
to accede to the Schengen agreement and was allowed to begin
participating in policy discussions on visas and passports.

-- by December 2004: The JHA Council should makes its
decision of October 26 final. Agreement on the technical
standards for biometric passports should also be finalized.

-- by January 2005: Biometrics proposals and the Common
Consular Instruction are re-written and approved; the clock
will begin ticking for the 18-month and 36-month
implementation deadlines for the two biometrics to be
included in passports.

-- February 2005: IVP nominee Frank Paul should begin a
three-week visit in the U.S. to coordinate on biometrics with
governmental and industry representatives.

-- May 1, 2005: The EU Border Management Agency should
become operational and help the Member States coordinate on
risk analyses and training, joint border control operations,
and purchasing of equipment. The agency will be located in
either Poland, Hungary, Estonia, Malta or Slovenia.

-- December 2005: The Schengen visa foils should include
digitized photographs. Most EU legal permanent residency
cards should also contain digitized photographs.

-- July 2006: All EU Member States should be issuing
biometric passports compliant with the ICAO standard.

-- October 2006: The central component of the VIS should be
operational with one biometric identifier (digitized
photographs) and alphanumerical data.

-- March 2007: The upgraded SIS2 should come online. Member
States will begin the process of linking their national visa
systems to the combined VIS/SIS2. The VIS should support the
biometric fingerprint function with search capabilities and
scanned supporting documents should be added to the VIS.

-- December 2007: All countries should be issuing visas,
residency cards and passports bearing two biometric
identifiers. Internal borders between old and new EU Member
States should be abolished. Preliminary decisions about
expanded use of the SIS2 and biometric-based searches in the
system should be taken.


34. (SBU) Because of the serious technological challenges and
the political/public debate that frequently surrounds the
issue of biometrics, some of these projected dates may slide.
The European Parliament (EP),which has questioned the need
for biometrics (reftel b) is expected to gain a stronger
voice on these matters in the coming years. Like some Member
States, the EP questions the costs of biometrics, both in
financial terms and in threats to civil liberties.
Furthermore, many of the costs associated with biometrics
will be born by the Member States.
Although the EC sets policy, it has very few teeth available
to force implementation. This could also adversely affect
speedy implementation of these measures.

--------------
Comment
--------------

34. (SBU) Given its extensive effort with regard to
biometrics, the EU is now on a parallel track with the US in
incorporating biometrics into travel documents. They have
demonstrated that they are equally interested in combating
terrorism and illegal immigration through the use of
biometrics, but the practical realities are extremely complex
since it involves 28 different countries, each with its own
policy reservations and resource limitations. Despite all
the progress the EU has made (even exceeding US standards by
moving to include two biometric indicators),they are
unlikely to meet our 10/26/2005 biometrics deadline, and are
sure to press for its extension or for individual waivers to
countries who are working hard but unable to meet the
deadline. Since standard-setting is an EU forte, it is also
possible we may see a future EU effort in multilateral fora
to incorporate two biometrics into all travel documents to
further bolster border controls.


35. (SBU) We should attempt to build on the progress the EU
has made to press harder to reach an agreement with the EU on
sharing lookout information on suspected terrorists and those
ineligible to receive visas to enter the EU -- in accordance
with Homeland Security Presidential Directive 6. During
consultations with CA/VO/BIP on October 27 in Brussels, the
EC stated that once the new systems are in place, information
sharing will be technically feasible. To bring the EU to
yes, however, we will have to come to some understanding with
them on the data privacy concerns which have formed a basic
stumbling block -- and to which the EU must also respond in
its efforts to strengthening its border control mechanisms.

SCHNABEL