Budapest Declaration on Machine Readable Travel Documents

Abstract

By failing to implement an appropriate security architecture, European governments have effectively forced citizens to adopt new international Machine Readable Travel Documents which dramatically decrease their security and privacy and increases risk of identity theft. Simply put, the current implementation of the European passport utilises technologies and standards that are poorly conceived for its purpose. In this declaration, researchers on Identity and Identity Management (supported by a unanimous move in the September 2006 Budapest meeting of the FIDIS “Future of Identity in the Information Society” Network of Excellence[1]) summarise findings from an analysis of MRTDs and recommend corrective measures which need to be adopted by stakeholders in governments and industry to ameliorate outstanding issues.

Introduction

Whilst still susceptible to traditional ID document abuse scenarios, new Machine Readable Travel Documents (MRTDs) offer numerous additional threats. From these we wish to stress that:

• In contrast to traditional ID documents, European MRTD data are remotely, transparently and non-interactively readable (from the perspective of the passport owner) from a distance of 2 to 10 meters. This is compounded by access control which is susceptible to circumvention or hacking (therefore risk of ubiquitous, unobserved authentication to MRTD data by authorised or unauthorised third parties, enabling tracking of people carrying a passport, for example when residing as a tourist in a foreign country)


• Use of biometric data stored on ID documents is exploitable by both the public and private sectors for additional purposes - a violation of European privacy principles. Moreover, biometrics themselves are based on probabilities, thus false positive and negative authentication is unavoidable and will potentially affect many European citizens every day.

more: http://www.fidis.net/press-events/press-releases/budapest-declaration/