Home › Blogs › Paul Templeton's blog

Australian Passport Information Service

Fri, 07/12/2007 - 9:12pm — Paul Templeton

I find the world an interesting place...your raise a concern hoping you are wrong and its confirmed...now I'm scared.

I have to get a new passport and I found a strange question that you have to agree to. It was about biometrics and what the intended use is.

Below is the email I sent to the Department of Foreign Affairs and Trade and their reply. Read it and be very scared.

When I spoke to them on the phone they had problems with my questions...I stressed my concern that biometrics was not bullet proof and someone some time in the future will bust it, they got quite short with me? I then raised the problem of this data being stored on a chip in the passport - the information is protected in Australia (Privacy Act) whilst I'm here but what happens on foreign soil? They where getting very short. They told me that they would only use the information in border control (in the future) for identifying me, I laughed and asked for a copy of their policy...they could not find one. They are now very perturbed with me now. They said it was a parlement act (Biometric chip in passport) and they are bound by the Privacy Act and that is the end off the story - accept the new passport and condition or get nothing...I'm now getting short. I spent most of the morning going from DFAT to Office of Privacy Commision to ASIO (no one answers the phone - are they trying to a trace???? This is my paranoi) to the Ombusman. All passed me back and forward. Last ditch was to put it into writing and vola read on. The top half is their reply and the bottom half is my question.

Note: in the middle you will see an inter-department forward to apis.tas@centrelink.gov.au - very interesting...Plus I put the bolding to highlight the key points.

Helen.Taylor@dfat.gov.au; on behalf of; passport.operations@dfat.gov.au

Dear Mr Templeton

Thank you for your enquiry to the Australian Passport Information Service
regarding Biometric issues.

The Passports web site extract that you quoted outlines the policy and
purpose of biometric matching. This process protects your interests as it
will indicate if you have been a victim of identity fraud.

The Australian privacy law applies to all data held regarding passport
applicants, both in Australia and overseas.

Yours sincerely,

Regards
Passport Operations
Department of Foreign Affairs and Trade,
Canberra
Tel 02 6261 3844
Mob 040158 7453
Fax 02 6112 3844

Passport
Operations/DFATL
Sent by: Phil To
Bell/People/DFATL passports_policy/People/DFATL@DFATL
cc
Tony Grenenger/People/DFATL@DFATL,
06/12/2007 01:51 Mark Porter/People/DFATL@DFATL
PM Subject
Fw: Biometrics Issues
[SEC=UNCLASSIFIED]

Forwarded for your action.
regards

Passport Operations
Dept of Foreign Affairs and Trade
Tel: +61 2 6261 1539

----- Forwarded by Phil Bell/People/DFATL on 06/12/2007 01:48 PM -----

apis.tas@centrelink.gov.au
To
06/12/2007 01:22 passport.operations@dfat.gov.au
PM cc

Subject
Re: Biometrics Issues
[SEC=UNCLASSIFIED]

Please find below an e-mail received at APIS today.

Regards,

Adam


"Paul Templeton" <>


06/12/2007 08:34 To <passports.australia@dfat.gov.au>
cc
Subject Biometrics Issues
[SEC=UNCLASSIFIED]
Reference

Expires

Hi Guys,

I have a problem with your policy (lack of) re biometrics. There seems to
be a clear concise documentation (available form your staff and your
website) on how data is kept, stored, accessed etc re Question 14 on the
passport application, points 2-4 under 'I understand that:'.

But the first point states my photograph will be used for biometric matching purposes
(biometric matching allows the passport photograph to be electronically
compared with other facial images to confirm identity). - this is the
problem area...where is the policy? who's facial images are you going to
scan mine against??? Your website has this to say about it...


Facial Recognition Technology

Facial recognition technology uses measurements of the face to match an
image against a 'gallery' of existing images. It is much more accurate than
manual matching as a means of confirming identity. Electronic matching
allows a facial image to be matched against a database containing millions
of images. Electronic matching also allows a facial image to be matched
against a watch list of images of known terrorists and other transnational
criminals.

Clearly this is an abuse of my privacy...this is equivalent of being put
into a line up at the local police station under suspicion of a
crime...Please clarify this as it is not clear. Send a copy of your policy
in regards to biometrics and the agencies who can access my detail and
under what situations. Also - in Australia my information is protected
under the Privacy Act but am I protected overseas???

Clarity on this subject would be good,

Thanks

Paul Templeton
0448540500


**********************************************************************
IMPORTANT: This e-mail is intended for the use of the addressee and may
contain information that is confidential, commercially valuable or subject
to legal or parliamentary privilege. If you are not the intended recipient
you are notified that any review, re-transmission, disclosure, use or
dissemination of this communication is strictly prohibited by several
Commonwealth Acts of Parliament. If you have received this communication in
error please notify the sender immediately and delete all copies of this
transmission together with any attachments.
**********************************************************************
Note By Me - Yes I've proberly breached some law by posting this - so let them come and take me away aha

Comments

Mon, 10/12/2007 - 9:29am — Matthew Davidson

I'm going to coin a new set

I'm going to coin a new set of laws. "The Laws of Authoritarian Technological Self-Delusion" state that:

  1. Any attempt by authorities to impose a purely technological solution to a social problem can only cause more harm than good.
  2. Even where the problem being addressed is genuine and serious, the solution will only interfere with the activities of the innocent, or at best, the guilty but incompetant.
  3. Any evidence demonstrating the in-principle impossibility of a technical solution will be treated as teething trouble, and will only strengthen the belief that next time it will work flawlessly.
  4. Anybody who exposes such evidence will be considered a threat to society and held up as an example of the sinister forces at work to undermine the security and prosperity of ordinary people, further justifying more hare-brained security measures.

In the case of biometric passports, the equipment necessary to skim the information off the chip without physically touching the passport, and then copy it onto a fake passport costs a few hundred dollars. This has been demonstrated in practically every country where they've been introduced, eg.:

Given that the Australian system "has been designed to allow for small changes in appearance", you can expect the system to throw up false positives or negatives; according to the Guardian story above, about 20-25% of the time.

So your chances of being "directed to a SmartGate assistance desk to be manually processed by a Customs Officer" because you've not matched your photograph might be as good as one in four. A real terrorist's chance of matching the photograph of a near-doppleganger who's had his biometric information undetectably pilfered might be something similar, or even better if he's selected a closer match than you with a photo of yourself with a different haistyle, beard, or glasses. Feel safer yet?

Of course the number of innocent passengers is considerably larger than the number of terrorists. To date Australia's post-911/Bali security crackdown has caught a GP who has a terrorist distant relative. (We showed him!) So going by this statistical sample of millions of perfectly harmless citizens verses zero actual terrorists, we can assume that using this system to put every Australian air traveller in a "virtual line-up" will catch no terrorists while incorrectly identifying many innocent people as terrorist suspects and kicking off a potential cascading cock-up scenario that leads to people being wrongly imprisoned and/or deported. (No! That sort of thing doesn't happen in Australia, does it?)

It's like Windows Genuine Advantage - a system nobody affected by it ever asked for, which by design will inevitably generate false positives, and is easy for the people it is designed to catch to circumvent. In practice WGA gives industrial-scale illegal software distributers a mechanism to "prove" their software is "genuine", and passport biometric chips give terrorists a way to fast-track themsleves through customs.

Ultimately the belief in infallible technical fixes for non-technical problems is a belief in technology as magic. Just because you deeply and sincerely want to believe that your magic is more powerful than the bad guys' magic, doesn't mean that there is such a thing as magic.

Mon, 10/12/2007 - 9:44am — Ruben Hillier

the interconnectedness of things....

As demonstrated by the Kevin Bacon affect and eluciadated by Doug, we can all be found to be associating with terrorists.

I guess the games up, we're scroogled.

Wed, 12/12/2007 - 9:50am — Matthew Davidson

Just read Scroogled. I think

Just read Scroogled. I think I'll use Tor every time I Google from now on.

Sat, 15/12/2007 - 9:53am — Matthew Davidson

I love it when smart people agree with me

...of course, the very definition of "smart" is "someone who agrees with me". Security guru Bruce Schneier says:

"...we've confused security with control, and instead of building systems for real security, we're building systems of control. Think of ID checks everywhere, the no-fly list, warrantless eavesdropping, broad surveillance, data mining, and all the systems to check up on scuba divers, private pilots, peace activists and other groups of people. These give us negligible security, but put a whole lot of control in the government's hands.

"Computing is heading in the same direction, although this time it is industry that wants control over its users. They're going to sell it to us as a security system -- they may even have convinced themselves it will improve security -- but it's fundamentally a control system. And in the long run, it's going to hurt security.

"Imagine we're living in a world of Trustworthy Computing, where no software can run on your Windows box unless Microsoft approves it. [...] Microsoft will tout this as the end of malware, until some hacker figures out how to get his software approved. That's the problem with any system that relies on control: Once you figure out how to hack the control system, you're pretty much golden. So instead of a zillion pesky worms, by 2017 we're going to see fewer but worse super worms that sail past our defenses."

Wed, 16/01/2008 - 9:46pm — Paul Templeton

inter-department forward apis.tas@centrelink.gov.au

I have found out that Australian Passport Information Service is a call centre provided by Centrelink - A good ploy to tie departments together making it easier to echange data - methinks
Sun, 01/08/2010 - 10:26pm — Anonymous

World Passport

In addition to my Australian passport I have a World Passport issued by the World Service Authority. This is NOT a biometric passport but is issued under the principles of the United Declaration of Human Rights and is similar in almost every respect to an Australian passport - being machine readable and with plenty of room for visas.

For a World Passport visit:

http://www.worldservice.org/docpass.html

The mandate for the WORLD PASSPORT is Article 13(2) of the Universal Declaration of Human Rights:

Everyone has the right to leave any country, including his own, and to return to his country.

The World Passport is a 30 page Machine Readable Travel Document (MRTD*) with alphanumeric code line, scanned-in passport photo and "ghost" security paper with embedded logo, the data page laminated, in 7 languages:

English, French, Spanish, Russian, Arabic, Chinese and Esperanto.

Each passport is numbered and each page contains the World Citizen logo as background. Two pages are reserved for affiliate identifications: diplomatic corps, organizations, firms, etc. There are nineteen visa pages. In the inside back cover, there is space for home address, next of kin, doctor, employer, driving license no. and national passport/identity number. The cover is blue with gold lettering.

See also http://www.worldgovernmenthouse.com/

for information.

Robert (Bob) Bain

Wed, 20/10/2010 - 3:22pm — Anonymous

This is very silly. My

This is very silly. My partner actually worked for this department (APIS) up until recently. They are a call center located only in Tasmania. My partner worked there for about a year and from what she has told me I 100% support all the policies for passports especially the security surrounding them. Take it from someone who worked for passports this above comment is silly. Lots of customers are paranoid about having a passport and why shouldn't they be? A passport is an extremely valuable document. But no matter what APIS says they will never be 100% satisfied. The passports are changed so often to add more security features. As long as you don't loose it or give your passport information to someone you don't know then you are safe. There is always human error in any department but after working for APIS for a year my partner had never come across any serious errors. She knows a lot of the inside security to do with fraud and the checks done with passports. She has told me how being questioned by a paranoid customer is so hard and maybe the person you spoke to doesn't handle that pressure well. But I will tell you that if it were my partner you had on the phone, as a very experienced operator she knows how to deal with that pressure. There is nothing wrong with passports, but I don't think even she could have convinced you of that. But after hearing her side of the story someone who WORKED there, I am convinced.