Carrington Events:are you prepared?

AUGUST 2015 VOLUME 21 ISSUE 4

ALSO:PADLOCKING THE PERIMETER

SOCIAL MEDIA IN INCIDENT MANAGEMENTTHE IDENTITY CHALLENGE

INTELLIGENT SURVEILLANCE

MAIN MEDIA SPONSOR TO:

THE GLOBAL JOURNAL OF AIRPORT & AIRLINE SECURITY

www.asi-mag.com

AN INTERVIEW WITH:

ABDULLA AL HASHIMI

28 17

AVSEC OPINION:

TONY TYLER

August 2015 Aviationsecurityinternational18 VISIT WWW.ASI-MAG.COM – NEW & IMPROVED

How can government and industry work effectively together to respond to the ‘identity challenge’?

How can we ensure that only those passengers who pose no risk to either aviation or the countries along their route, are processed quickly and efficiently, whilst being absolutely certain that we are basing our risk assessment on people whose identity can be properly verified?

Much of the answer lies in the integrity of the travel document – our ability to determine that it is neither forged, nor counterfeit nor fraudulently obtained, and we can be absolutely sure it belongs to the person presenting it.

Raising the Bar: the Value of International StandardsThe work of the International Civil Aviation Organisation (ICAO) has created a valuable set of standards in the development and advancement of high-tech documents for international travel. Specifically, ICAO Document 9303 provides detailed specifications for machine-readable passports, visas and ID cards (‘travel documents’) for use in crossing international borders.

THE IDENTITY CHALLENGE:VERIFYING TRAVEL DOCUMENT INTEGRITY, QUASHING BREEDER DOCUMENT FRAUDAs more people travel to more destinations than at any time in our history, passing through aviation security checkpoints and crossing international borders in the process, the challenge of verifying traveller identities has never been greater. This challenge is made more complex by rising expectations of shorter queues and reduced wait times, and the greater demands being placed upon comparatively few (and dwindling) numbers of trained staff available to perform the essential functions of verifying that travel documents are a) genuine, b) have not been reported as lost or stolen, and c) belong to the actual people presenting them. This is set within the prevailing need to ensure the person does not present a risk to aviation or, indeed, to the country they are leaving, travelling via or, ultimately, of their final destination. Matthew Finn delves into the issue of travel document integrity and breeder document fraud, both key factors in establishing a passenger’s genuine identity.

August 2015 Aviationsecurityinternational18 VISIT WWW.ASI-MAG.COM – NEW & IMPROVED

August 2015 Aviationsecurityinternational www.asi-mag.com 19

Developments in traditional secure document printing have rendered the task of forging and counterfeiting travel documents considerably more difficult – but not impossible. The availability of specialist inks, laminates, paper, laser perforation, holograms, optically variable imaging devices and other ‘difficult to replicate’ features has meant that the modern day passport, as the most common example of a machine readable travel document (or MRTD), can be subjected to a range of controls to quickly determine its authenticity.

These developments have been made even more robust with the growing adoption of ‘electronic Machine Readable Travel Documents (eMRTDs)’ – next generation passports that contain biometric (and other) data in a contactless integrated circuit chip, adopting the absolute latest thinking and recommendations as set out in ICAO 9303.

On the one hand, the myriad of document security features present in a modern travel document enable a rapid examination to ensure it is genuine; on the other hand, by using a one-to-one verification to confirm that the biometric data contained in the chip matches that of the person presenting it, the control process is able to establish that the genuine travel document actually belongs to the person presenting it. Job done? Well, not quite.

Moving GoalpostsSecurity specialists around the world routinely talk about “the need to stay one step ahead” of those posing a risk or seeking to do us harm. Every measure needs a counter-measure. The advancements in document security and our ability to verify it is genuine and belongs to the person presenting it is, of course, an important step forward. But the goalposts are moving. And we need to keep up with – and develop counter-measures for – new trends and the constantly evolving challenge of managing and verifying identities.

In 2007, ICAO reported that document fraud amounted to 54% of forgery detections at the border. Of these, 16% were counterfeit documents, 19% were attributed to substitutions of the photo and a further 19% were as a result of substitutions to the biographic data page. For the same period, ICAO reported that identity

fraud amounted to 31%, with 21% attributable to imposters and lookalikes and the remaining 10% to fraudulently obtained genuine travel documents – arguably the hardest to detect.

Only two years later that picture had changed dramatically. In 2009, identity fraud amounted to a staggering 71% of forgery detections, 48% attributable to imposters and lookalikes and a worrying 23% – more than double – attributable to documents that had been fraudulently obtained. Conversely, document fraud – traditionally the more common of the two and arguably the easier to detect – had dropped to almost half at 29%.

In real terms, this means that identity fraud is on the rise – and the rise is significant. More recent figures aren’t widely available, but it is safe to assume that this upward trend has continued and that our challenge now is more about determining that the document truly belongs to its holder rather than whether the document itself is a forgery or counterfeit.

International CooperationIn March 2014, the world woke up to what has become the airline industry’s greatest mystery – the tragic disappearance of Malaysian Airlines flight 370. While the fate of that aircraft and all of the passengers and crew on board remains a complete mystery - even though the flaperon which was recently washed ashore in Reunion turned out to be from MH370 - and one which fuels speculation by security specialists and conspiracy theorists alike, one

key fact drew considerable attention: that two passports, reported to the international police organisation, INTERPOL, as ‘stolen’, were able to be used by two of the passengers on board. There followed considerable speculation that the holders of these documents were linked to the aircraft’s disappearance and had links to terror organisations.

Ultimately, INTERPOL concluded that neither Pouria Nour Mohammad, 19, nor Seyed Mohammed Rezar Delawar, 29, both Iranian nationals, had any links to terrorism and were in fact seeking to circumvent document control procedures by travelling circuitously from Thailand to Europe via China in order to claim asylum in the EU.

MH370 put document control procedures in the spotlight with difficult questions being asked about how documents already reported as stolen could still be used by imposters for international travel. Understandably, public concern focused on how easy it would be for a terrorist, rather than an asylum seeker, to obtain and use a stolen passport and not be detected

“…in 2009, identity fraud

amounted to a staggering

71% of forgery detections,

48% attributable to imposters

and lookalikes and a

worrying 23% attributable

to documents that had been

fraudulently obtained…”

Iranian passengers carrying stolen travel documents before boarding MH370 (Credit: Malaysian Police)

August 2015 Aviationsecurityinternational20 VISIT WWW.ASI-MAG.COM – NEW & IMPROVED

either by the airline or, indeed, the government performing outbound border control in the departure country.

In the months that followed, both INTERPOL and the International Air Transport Association (IATA) spoke about the need for international cooperation and the need for more stringent document control procedures that could verify, in real-time, whether a document being used by a passenger had ever been reported as stolen or lost and recorded as such in INTERPOL’s Stolen & Lost Travel Document (SLTD) database. There is now an urgent need for this capability to be widely available across the air transport industry and for airlines and air transport operators alike, not just governments, to be able to perform checks on passengers’ travel documents.

The good news is that a number of airlines, and Qatar Airways being first among them, are now working with INTERPOL and developing an industry-wide initiative known as i-Checkit which performs precisely that function.

The Promise of BiometricsAgainst this backdrop, much has been said of the promise of biometrics and the role this particular technology can play in delivering a greatly enhanced document security capability. Adoption, however, has been incredibly slow. There remains a significant gap in terms of the capabilities some governments have – and others do not.

For the most part, biometric passports have been used in Automated Border Control (ABC) or Registered Traveller Programmes (RTPs). Clearly, there are significant benefits to be derived

from offering automated passenger processing for eligible passengers holding e-Passports that contain chips with biometric data. This provides an opportunity for most, if not all, of the document authentication process to be automated and for the document holder’s identity to be verified, affording passengers a welcome expedited process when crossing international borders. This is surely good news for an industry under pressure to process more passengers in less time and respond to the challenge of developing risk-based approaches to both aviation and border security.

Where the promise fails to deliver all of the benefits is when these programmes are limited to a fraction of the travelling public. In Europe, for example, only adult passengers (18+) holding a valid e-Passport from a country belonging to the European Economic Area (EEA) are eligible to use a typical Automated Border Control programme. Not so good news for EEA nationals travelling with children. And not so good news for the millions of e-Passport holders

from countries outside of Europe, (i.e. Third Country Nationals) who may have even been issued with a biometric visa from the very country whose Automated Border Control programme they cannot, currently, use.

In time, these limitations will be removed and larger populations of the travelling public will be eligible to benefit from biometric-based programmes that offer an expedited process and, in parallel, offer concerned governments an opportunity to focus more of their energy and attention (and resources) on the passengers who potentially pose a risk, or about whom they know much less, or who are yet to be issued with an e-Passport.

Keeping up to Date with the Pace of ChangeYet even with these important developments, it is vital industry and government keep pace with change. At a more granular level, there are techniques in authentication that demand operational biometric systems be connected to (or updated by) international databases. It would be worrying to say the least if an Automated Border Control system performed all of the expected document authentication and identity verification functions (i.e. it’s a good document and it appears to belong to the person holding it) without verifying the validity of the digital certificates used by the issuing state to sign the data held and encrypted on the passport’s chip.

FRONTEX, the European Union’s External Borders Agency, has carried out some excellent work in this regard and has published a series of valuable guidelines, chief among them the ‘Best Practice Technical Guidelines for Automated Border Control Systems’.

These guidelines talk in depth about the need for Passive Authentication and the need for a verification mechanism to check if the data on the chip of an e-MRTD is authentic and unforged, by tracing it back to the Country Signer Certificate Authority (CSCA) of the issuing country.

Integrity in the ProcessFrom traditional document security printing techniques to the latest developments in biometric travel documents and the systems that process them, it is the integrity of the end-to-end process that ultimately builds confidence that these new measures are robust and therefore fit for purpose.

“…MH370 put document

control procedures in the

spotlight with difficult

questions being asked about

how documents already

reported as stolen could still

be used by imposters for

international travel…”

The integrity of the breeder document, such as a birth certificate, is as important as the integrity of the travel document itself.

August 2015 Aviationsecurityinternational www.asi-mag.com 21

Recognising that identity fraud is very much on the rise and understanding that the latest figures show 23% of fraud is attributable to fraudulently obtained documents, we are by no means out of the woods yet.

Regrettably, we are living in an age where Failed States and Fragile States are on the rise. What happens to the document issuance process in these countries when they fail? And what happens, today, in those States where it is relatively easy to obtain a fake birth certificate or other fake breeder documents?

Where vulnerabilities exist, they will be exploited. And we are likely to continue to see an upward trend in fraudulently obtained genuine travel documents being presented at borders and security checkpoints. If there is no confidence in the integrity of the document issuance process,

there cannot be any confidence in the authenticity of the document being presented or the veracity of the holder’s identity.

The Road AheadMoving forward, there needs to be greater collaboration between government and industry. Initiatives such as INTERPOL’s i-Checkit need to be deployed around the world on a consistent basis to prevent lost and stolen travel documents being used for international travel. Biometric programmes need to keep pace with the latest developments and ensure they perform techniques such as Passive Authentication and interface with the latest catalogue of valid digital certificates available from, at the very least, all countries whose nationals are eligible to use those biometric systems. And there needs to be international assistance offered to countries who are in need of support and guidance to help them enhance the integrity of their travel document issuance process.

In Europe, we are in the midst of a migrant crisis. In Northern France alone, the population of undocumented irregular migrants camping out in Calais around the entrance to Eurotunnel

has risen from circa 600 in January this year to more than 5000 by mid-July. Given the hardships this group of people have already had to endure to flee conflicts and leave their countries behind, it is only a matter of time until the opportunity to fraudulently obtain a genuine travel document presents itself. And when it does, it will become exceptionally difficult to verify the true identity of those seeking to travel and cross borders – not just for those hoping to claim asylum or seek a better life, as was the case for the two MH370 passengers, but also for those who seek to do harm to our industry, our societies or our way of life.

If we cannot establish a person’s identity, we cannot ascertain the risk he or she may pose to the aviation industry or, indeed, to the countries they are travelling to along the way.

Matthew Finn is the Managing Director of AUGMENTIQ, a specialist consultancy practice working internationally with senior leaders from government and industry to inspire new thinking, drive change and transform operations in aviation, transportation and border security.

More than 75 speakers include:

• Arron Baker, Immigration New Zealand

• Emmanuel Berton, Aeroport de Paris, France

• Florian Forster, International Organization for Migration, Switzerland

• Krum Garkov, EU-Lisa, Belgium

• Frøy Løvåsdal, Norwegian ID Centre, Norway

• Helen N. Marano, World Travel & Tourism Council, UK

• Fares Rahmun, EU Visa Information System, Germany

• Richard Rinkens, European Commission, Belgium

• David Ryder, ACI EUROPE, Belgium

Topics include:

• ID management

• Using biometrics at borders

and in travel

• Privacy and the customer

experience

• New biometric technology

and applications

“Professionally very relevant and topical; really good speakers who know their subject”

Biometrics 2014 delegate

ORGANISED BY: IN PARTNERSHIP WITH: SPONSORED BY: PREMIER MEDIA PARTNER:

www.biometricsandidentity.com

#biometrics2015#biometricslive

REGISTERNOW

Register now for Biometrics 2015 for a complete review on all aspects of using biometrics in ID management for travel and border control

Free exhibitionSign up now for your freevisitor pass.

BIOM2015_Ad-175x121.indd 1 21/07/2015 10:21

“…what happens in those

States where it is relatively

easy to obtain a fake birth

certificate or other fake

breeder documents…”