Home › Blogs › Paul Templeton's blog

Australian Passport Information Service

Fri, 07/12/2007 - 8:12pm — Paul Templeton

I find the world an interesting place...your raise a concern hoping you are wrong and its confirmed...now I'm scared.

I have to get a new passport and I found a strange question that you have to agree to. It was about biometrics and what the intended use is.

Below is the email I sent to the Department of Foreign Affairs and Trade and their reply. Read it and be very scared.

When I spoke to them on the phone they had problems with my questions...I stressed my concern that biometrics was not bullet proof and someone some time in the future will bust it, they got quite short with me? I then raised the problem of this data being stored on a chip in the passport - the information is protected in Australia (Privacy Act) whilst I'm here but what happens on foreign soil? They where getting very short. They told me that they would only use the information in border control (in the future) for identifying me, I laughed and asked for a copy of their policy...they could not find one. They are now very perturbed with me now. They said it was a parlement act (Biometric chip in passport) and they are bound by the Privacy Act and that is the end off the story - accept the new passport and condition or get nothing...I'm now getting short. I spent most of the morning going from DFAT to Office of Privacy Commision to ASIO (no one answers the phone - are they trying to a trace???? This is my paranoi) to the Ombusman. All passed me back and forward. Last ditch was to put it into writing and vola read on. The top half is their reply and the bottom half is my question.

Note: in the middle you will see an inter-department forward to apis.tas@centrelink.gov.au - very interesting...Plus I put the bolding to highlight the key points.

Helen.Taylor@dfat.gov.au; on behalf of; passport.operations@dfat.gov.au

Dear Mr Templeton

Thank you for your enquiry to the Australian Passport Information Service
regarding Biometric issues.

The Passports web site extract that you quoted outlines the policy and
purpose of biometric matching. This process protects your interests as it
will indicate if you have been a victim of identity fraud.

The Australian privacy law applies to all data held regarding passport
applicants, both in Australia and overseas.

Yours sincerely,

Regards
Passport Operations
Department of Foreign Affairs and Trade,
Canberra
Tel 02 6261 3844
Mob 040158 7453
Fax 02 6112 3844

Passport
Operations/DFATL
Sent by: Phil To
Bell/People/DFATL passports_policy/People/DFATL@DFATL
cc
Tony Grenenger/People/DFATL@DFATL,
06/12/2007 01:51 Mark Porter/People/DFATL@DFATL
PM Subject
Fw: Biometrics Issues
[SEC=UNCLASSIFIED]

Forwarded for your action.
regards

Passport Operations
Dept of Foreign Affairs and Trade
Tel: +61 2 6261 1539

----- Forwarded by Phil Bell/People/DFATL on 06/12/2007 01:48 PM -----

apis.tas@centrelink.gov.au
To
06/12/2007 01:22 passport.operations@dfat.gov.au
PM cc

Subject
Re: Biometrics Issues
[SEC=UNCLASSIFIED]

Please find below an e-mail received at APIS today.

Regards,

Adam


"Paul Templeton" <>


06/12/2007 08:34 To <passports.australia@dfat.gov.au>
cc
Subject Biometrics Issues
[SEC=UNCLASSIFIED]
Reference

Expires

Hi Guys,

I have a problem with your policy (lack of) re biometrics. There seems to
be a clear concise documentation (available form your staff and your
website) on how data is kept, stored, accessed etc re Question 14 on the
passport application, points 2-4 under 'I understand that:'.

But the first point states my photograph will be used for biometric matching purposes
(biometric matching allows the passport photograph to be electronically
compared with other facial images to confirm identity). - this is the
problem area...where is the policy? who's facial images are you going to
scan mine against??? Your website has this to say about it...


Facial Recognition Technology

Facial recognition technology uses measurements of the face to match an
image against a 'gallery' of existing images. It is much more accurate than
manual matching as a means of confirming identity. Electronic matching
allows a facial image to be matched against a database containing millions
of images. Electronic matching also allows a facial image to be matched
against a watch list of images of known terrorists and other transnational
criminals.

Clearly this is an abuse of my privacy...this is equivalent of being put
into a line up at the local police station under suspicion of a
crime...Please clarify this as it is not clear. Send a copy of your policy
in regards to biometrics and the agencies who can access my detail and
under what situations. Also - in Australia my information is protected
under the Privacy Act but am I protected overseas???

Clarity on this subject would be good,

Thanks

Paul Templeton
0448540500


**********************************************************************
IMPORTANT: This e-mail is intended for the use of the addressee and may
contain information that is confidential, commercially valuable or subject
to legal or parliamentary privilege. If you are not the intended recipient
you are notified that any review, re-transmission, disclosure, use or
dissemination of this communication is strictly prohibited by several
Commonwealth Acts of Parliament. If you have received this communication in
error please notify the sender immediately and delete all copies of this
transmission together with any attachments.
**********************************************************************
Note By Me - Yes I've proberly breached some law by posting this - so let them come and take me away aha

Comments

Mon, 10/12/2007 - 8:29am — Matthew Davidson

I'm going to coin a new set

I'm going to coin a new set of laws. "The Laws of Authoritarian Technological Self-Delusion" state that:

  1. Any attempt by authorities to impose a purely technological solution to a social problem can only cause more harm than good.
  2. Even where the problem being addressed is genuine and serious, the solution will only interfere with the activities of the innocent, or at best, the guilty but incompetant.
  3. Any evidence demonstrating the in-principle impossibility of a technical solution will be treated as teething trouble, and will only strengthen the belief that next time it will work flawlessly.
  4. Anybody who exposes such evidence will be considered a threat to society and held up as an example of the sinister forces at work to undermine the security and prosperity of ordinary people, further justifying more hare-brained security measures.

In the case of biometric passports, the equipment necessary to skim the information off the chip without physically touching the passport, and then copy it onto a fake passport costs a few hundred dollars. This has been demonstrated in practically every country where they've been introduced, eg.:

Given that the Australian system "has been designed to allow for small changes in appearance", you can expect the system to throw up false positives or negatives; according to the Guardian story above, about 20-25% of the time.

So your chances of being "directed to a SmartGate assistance desk to be manually processed by a Customs Officer" because you've not matched your photograph might be as good as one in four. A real terrorist's chance of matching the photograph of a near-doppleganger who's had his biometric information undetectably pilfered might be something similar, or even better if he's selected a closer match than you with a photo of yourself with a different haistyle, beard, or glasses. Feel safer yet?

Of course the number of innocent passengers is considerably larger than the number of terrorists. To date Australia's post-911/Bali security crackdown has caught a GP who has a terrorist distant relative. (We showed him!) So going by this statistical sample of millions of perfectly harmless citizens verses zero actual terrorists, we can assume that using this system to put every Australian air traveller in a "virtual line-up" will catch no terrorists while incorrectly identifying many innocent people as terrorist suspects and kicking off a potential cascading cock-up scenario that leads to people being wrongly imprisoned and/or deported. (No! That sort of thing doesn't happen in Australia, does it?)

It's like Windows Genuine Advantage - a system nobody affected by it ever asked for, which by design will inevitably generate false positives, and is easy for the people it is designed to catch to circumvent. In practice WGA gives industrial-scale illegal software distributers a mechanism to "prove" their software is "genuine", and passport biometric chips give terrorists a way to fast-track themsleves through customs.

Ultimately the belief in infallible technical fixes for non-technical problems is a belief in technology as magic. Just because you deeply and sincerely want to believe that your magic is more powerful than the bad guys' magic, doesn't mean that there is such a thing as magic.

Mon, 10/12/2007 - 8:44am — Ruben Hillier

the interconnectedness of things....

As demonstrated by the Kevin Bacon affect and eluciadated by Doug, we can all be found to be associating with terrorists.

I guess the games up, we're scroogled.

Wed, 12/12/2007 - 8:50am — Matthew Davidson

Just read Scroogled. I think

Just read Scroogled. I think I'll use Tor every time I Google from now on.

Sat, 15/12/2007 - 8:53am — Matthew Davidson

I love it when smart people agree with me

...of course, the very definition of "smart" is "someone who agrees with me". Security guru Bruce Schneier says:

"...we've confused security with control, and instead of building systems for real security, we're building systems of control. Think of ID checks everywhere, the no-fly list, warrantless eavesdropping, broad surveillance, data mining, and all the systems to check up on scuba divers, private pilots, peace activists and other groups of people. These give us negligible security, but put a whole lot of control in the government's hands.

"Computing is heading in the same direction, although this time it is industry that wants control over its users. They're going to sell it to us as a security system -- they may even have convinced themselves it will improve security -- but it's fundamentally a control system. And in the long run, it's going to hurt security.

"Imagine we're living in a world of Trustworthy Computing, where no software can run on your Windows box unless Microsoft approves it. [...] Microsoft will tout this as the end of malware, until some hacker figures out how to get his software approved. That's the problem with any system that relies on control: Once you figure out how to hack the control system, you're pretty much golden. So instead of a zillion pesky worms, by 2017 we're going to see fewer but worse super worms that sail past our defenses."

Wed, 16/01/2008 - 8:46pm — Paul Templeton

inter-department forward apis.tas@centrelink.gov.au

I have found out that Australian Passport Information Service is a call centre provided by Centrelink - A good ploy to tie departments together making it easier to echange data - methinks