BIOMETRICS: EU TECHNICAL STANDARDS FOR PASSPORTS

UNCLAS SECTION 01 OF 03 BRUSSELS 000614

SIPDIS

SENSITIVE

DEPARTMENT FOR CA AND EUR/ERA; DHS FOR BTS, CBP, ICE, AND
CIS; DOJ FOR CRM; ROME ALSO FOR DHS - ACORSANO

E.O. 12958: N/A
TAGS: CPAS CVIS CMGT PREL SMIG KCRM KFRD EUN USEU BRUSSELS
SUBJECT: BIOMETRICS: EU TECHNICAL STANDARDS FOR PASSPORTS
AND FINGERPRINTS

REF: (A) STATE 23029 (B) 04 BRUSSELS 4844


1. (SBU) Summary. The EU is set to approve a decision on
technical standards related to biometrics in travel documents
by the end of February. From that point, EU Member States
will have 18 months to begin issuing passports that contain
digitized photographs on contactless chips. A separate
decision which will outline the technical standards for
including digitized fingerprints in passports is still under
discussion. The European Commission (EC) envisions limiting
access to the digitized fingerprints. However, agreements
with third countries may be permitted so that foreign
officials can verify the identity of the passport holder
through a fingerprint comparison. National laws will govern
the usage of digitized fingerprints that are collected as
part of the passport application but kept in national
databases. Some Member States have questioned the EC
regulation that mandates universal collection of fingerprints
from passport applicants, noting that fingerprints of
children under age seven are often unverifiable due to size.
Although the European Parliament objected to including
digitized fingerprints in passports, its opinion was ignored
by the EU Council. End Summary.

--------------
Technical Standards
--------------


2. (SBU) The European Commission (EC) has finalized its
proposal for most technical standards related to biometrics
in passports and has gained approval from the Article 6
committee. Within the next few days, the official
translations of this decision will be sent to national
capitals, and final approval by the EU Council is expected
before the end of February. The decision will cover the EU's
overall approach to biometrics in passports, as well as
specific standards related to the incorporation of digitized
photographs. Standards such as the scope and limitation of
biometrics, storage requirements and medium, passport and
chip layout, data security issues and other technical details
will be defined in the decision.


3. (SBU) Once approved, the 18-month implementation phase for
the EU Member States begins. All Member States will need to
be issuing passports that comply with the ICAO standard by
the end of August 2006 (a date which would meet the U.S.
deadline only if Congress agrees to a second one-year
postponement). Member States may, however, begin issuing
passports as soon as they are ready. Belgium is already
issuing passports with biometrics, and the EC believes that
Germany may follow shortly.

--------------
Fingerprints and Access
--------------


4. (SBU) The EC is working on a separate decision that will
cover technical standards related specifically to passport
fingerprints. According to the official at DG Justice,
Freedom and Security (JFS) drafting the decision, the EC will
require only two fingerprints: plain impressions of the left
and right index fingers stored on the chip as images. Once
this regulation is adopted, the 36-month implementation
period to add digitized fingerprints to national passports
begins.


5. (U) The use of digitized fingerprints, once they are
incorporated into passports, is limited by Article 4.3 of EC
Regulation 2252 entitled "standards for security features and
biometrics in passports and travel documents issued by the
Member States." The regulation states that the biometric
features "shall only be used for verifying: a) the
authenticity of the document and b) the identity of the
holder by means of directly available comparable features
when the passport or other travel documents are required to
be produced by law."


6. (SBU) The EC regulation, however, does not govern the use
of the fingerprints collected by Member States during the
passport issuance procedure. Member States may decide to
retain these fingerprints in national databases. National
laws will govern whether collected fingerprints can be run
against national criminal databases as part of the passport
issuance process, or subsequently used for law enforcement or
other purposes (e.g., identifying victims of the tsunami).
The EC is not aware of any Member State currently collecting
fingerprints as part of the passport application process.
Some Member States, however, do collect fingerprints for
national identity cards, which are in turn used as primary
documents for passport issuances.


7. (SBU) The EC,s passport fingerprint regulation will also
cover the issue of access. According to the drafting
official at JFS, the EC will probably opt for "extended
access control" for the part of the passport contactless chip
that contains the fingerprints. Unlike the biographic data
and digitized photograph, which will be protected with "basic
access control" (i.e., once the passport is swiped the data
flashes up on the screen),the fingerprints will require an
access key. The key on the chip will need to match the key
that is programmed into the passport reader. If the two keys
match, the fingerprint data will also appear on the screen.


8. (SBU) The EC decision will require all 25 EU Member States
to give each other access keys to the fingerprint data in the
passports. The regulation might also allow for agreements
with third countries. This would enable an EU Member State
to give the U.S. or other third country the access key for
their national passports and allow extended access to the
fingerprints. There has been no discussion yet about whether
such access would need to be reciprocal. Presumably, third
countries would be limited to use this access only for the
purposes described in paragraph 5.

--------------
Biometrics and Children
--------------


9. (SBU) Two of the Member States that are furthest along in
incorporating biometrics into passports have raised questions
over the provision in Article 1 of EC regulation 2252 that
requires all passports to contain digitized photographs and
fingerprints, including those issued to children.


10. (SBU) The Netherlands sent the EC an interim report based
on a pilot project undertaken in six municipalities which
concludes that collecting biometrics from children under age
7 is unfeasible. Of the 610 voluntary participants under the
age of 16, there was a verification failure rate of 100
percent for fingerprints collected from children ages two and
under. The size of the finger (and thus the print) was too
small for identifying features to be selected for a proper
comparison. The mobility of these children also contributed
to collection flaws. The study also said that the facial
images collected for babies resulted in verification failure
in 25 percent of the cases. For children ages 3-6,
fingerprints were unusable in 29 percent of the cases (both
prints) with only one print useable in and an additional 7
percent of the cases. Photograph verification failed in 11
percent of the cases for this age group. Based on these
results and the fact that the Netherlands still allows for
family passports, Dutch authorities have suggested that the
EC amend regulation 2252 to exempt children from the
biometrics requirement.


11. (SBU) Germany has also expressed its concern to the EC
about biometrics for children. According to the EC, Germany
does not plan to incorporate biometrics into its special
passports for children that are issued by over 6000
municipalities across the country. This will not violated
regulation 2252 since Article 1.3 exempts the biometric
requirement for passports having a validity of 12 months or
less, an exemption which covers the German child passport.

--------------
Parliament,s Opinion and Future Role
--------------


12. (U) On December 1, the European Parliament passed a
non-binding resolution (471 votes for, 118 against, and 6
abstentions) regarding the EC,s proposal on biometrics in
passports. MEPs agreed on the inclusion of digitized
photographs, but insisted that digital fingerprints remain
optional for the Member States. They also opposed the
establishment of a central database for EU passport
information, alleging potential risks to abuse of the data
and mission creep. MEPs stated that biometrics should only
be used to match the traveler with the document and should
not be used for background checks. Furthermore, MEPs called
for the regulation to come into effect only if and when the
national data protection authorities were given adequate
investigative powers and resources to ensure data protection.


13. (U) Because of the EC governmental structure in place in
2004, the Council was able to ignore many of the
Parliament,s concerns when it adopted Regulation 2252 on
December 13.


14. (U) However, on December 15, the Council adopted a
decision which substantially strengthens the Parliament,s
role in most decisions related to border management. As of
January 1, the Parliament,s role has been elevated to a
"co-decision making" procedure. The December 13 decision
also modifies the procedure within the Council on all border
matters except legal immigration from unanimity to "qualified
majority voting". (Note: The UK, Ireland and Denmark will
not be affected by many of these decisions because of their
negotiated opt-outs. End Note.)

--------------
Comment
--------------


15. (SBU) While the procedural changes should speed up the
decision-making process on the Council side of the house, the
Parliament,s role will likely prove a brake on key USG goals
such as information sharing and other measures to enhance
international transportation security. Issues that the
Parliament holds dear, like data protection and privacy, will
need to be addressed more robustly before the EC,s proposals
can be adopted.


16. (SBU) The EC has not applauded Belgium for its early lead
in rolling out a biometric passport, particularly since it
did not wait for the technical standards decision to be
finalized. One of the primary motives for the EC to exert
competence in the passport process was to play a coordinating
role and ensure interoperability. The EC notes that without
the readers and other necessary infrastructure in place, the
Belgian biometric passports are virtually meaningless;
currently, they cannot even be read at the Brussels airport.
Nevertheless, the EC understands Belgium,s particular
interest in spearheading the move to more secure passports
because of its probationary status in the visa waiver program.

MCKINLEY
.