• Home /
• News /
• 2004 /
• December /
• Statewatch News Online: Update: 5 Jan 2005: EU: Visa security policy unworkable (1)

Statewatch News Online: Update: 5 Jan 2005: EU: Visa security policy unworkable (1)

28 March 2012

Update: 5 January 2005
EU: Biometric visa policy unworkable

- Council Presidency recommending current proposal be abandoned due to "collision" of chips and Commission asked to amend its proposal

---

After the meeting of the Council's Visa Working Party meeting on 7-8 December the incoming Luxembourg Presidency circulated a "Note" proposing two options for biometric visas and residence permits - all of which would mean that the current proposal would have to be changed and the European Commission asked to prepare an amended proposal. These options being the only ones following the technical report of "collision problems" between chips (see previous analysis).

At the meeting of the Visa Working Party it was established that a majority of EU member states issued residence permits in a card format (rather than a "sticker" in a passport of third country nationals) - Germany, however, "could not accept this solution" as it issued residence permits in a "sticker" format. The Commission commented that the same "collision" problem would arise as for visas if the "sticker" format were used and it seemed "useless" to pursue this option further.

For visas the Presidency suggested there were two options: either issue a separate "smartcard" (with biometric data)to visa holders or only incorporate biometric data into the planned Visa Information System (VIS). France and Italy were not happy with only having two options but "several delegations" supported the Presidency idea and "some also expressed a priority for awaiting the VIS system and not to seek any costly intermediary solutions.

Just before Xmas, 21 December 2004, the incoming Luxembourg Council Presidency sent a "Note" to the Visa Working Party backing the two options proposal from the previous Netherlands Presidency.

For visas the first option would be to issue a "separate smart card with the visa sticker", as a storage medium for the biometric data; the second option would be to store the biometric data only in the Visa Information System (VIS) (which may be starting by 2007) and not on the sticker itself.

The Presidency "Note" says that as "the majority of the delegations seem to be in favour of the second solution, it is suggested that the biometric data would only be stored in the VIS and not on the visa sticker itself." If agreed the Commission would be invited to amend its proposal.

For residence permits two options are also proposed, the first option would be to issue a "separate card on which biometric data would be stored if the residence permit were issued in the form of a sticker"; the second option would be to "allow the issue of residence permits only in the form of a card."

A "large number of Member States" already issue the residence permit only in the form of a separate card and considering and a number of Member States are considering abolishing the other formats currently used, the Luxembourg presidency suggests the adoption of the second option. If agreed the Commission would be invited to amend its proposal.

The Council's Visa Working Party is scheduled to discuss these options at its meeting in Brussels on 12-13 January 2005. Meanwhile the European Parliament is due to discuss (and then vote on) the Coelho report on this proposal at its plenary session on Monday next, 10 January 2005. This report is based on the original Commission proposal which is now known to be unworkable and which will now have to be amended (both legally and technically).

The preferred solution for visas, namely that biometrics(photo and fingerprints) only be stored in the central VIS system, would seem to present an obvious problem (just about as obvious as the "collision problem" was back in 2003). If the biometric data is not in the visa, but only in the VIS the only way - since they would not have access to the biometric data within the visa itself - would be to take the fingerprints and/or facial scan of the people entering the EU with a visa either at an airport, seaport or land border. This would be very time-consuming, costly and in some cases lead to long queues while peoples' details are checked and cleared.

Note from Presidency to the Visa Working Group (doc no: 16257/04, 21.12.04) (pdf)

Analysis filed on: 24 December 2003
EU: Biometric visa policy unworkable

- insertion of chips would lead to "collisions" with visa chips from other countries
- ePassport chip would be "killed" by eVisa chip
- current deadline cannot be met, proposal unworkable

---

The European Parliament was due to adopt its report on the proposed Regulation on a uniform format for visas and residence permits for third country nationals at its plenary session on 13-16 December in Strasbourg. But due to a mixed-up two reports by Mr Coelho (one on uniform format for visas and the other on tackling vehicle crime with cross-border implications) were put on the agenda instead of one. When the parliament session opened on Monday (13 December) an alliance of PSE, ALDE, Greens and GUE MEPs succeeded, by 141 votes to 111, in getting the report on a uniform format for visas taken off the agenda. This is perhaps just as well for quite different reasons.

A secret report (Technical report to Council saying that the scheme will not work, doc no: 14534/04, 11.11.04) sent to the Council (the 25 governments) dated 11 November 2004 with the opinion of the committee looking at the technical implementation of the new visas concluded that:

"the solution envisaged by the draft regulation is not technically feasible"

The reason had been pointed out by at least two member states more than a year ago, in September 2003, and should have been pretty obvious from the start. The EU proposal envisages putting a "contactless chip" into visas attached to passports. But what if other countries want to insert chips in their own passports or to add a chip in their visas? What if a passport contains several visas with chips in them? This leads to what is called "a collision problem" which renders the EU visa chip unworkable. "Collision" is described as:

"the interference between various chips and the reading device, eg: due to the de-tuning of the resonance frequency, resulting in malfunction"

It is surprising that the EU thought it could act unilaterally and assume that it, and only it, would potentially use chips in passports and visas and had not considered whether non-EU states might object to passports issued to their own citizens being interfered with by EU issuing authorities (usually consulates).

The "collision problem" is two fold: first there is a "risk of failure due to interference between eVisa chips" (ie: if several states have inserted chip visas) and second, and more fundamentally, there is even the "risk of failure due to interference between ePassport and eVisa". As the report puts it, if non-EU countries use "ePassports" (as the EU intends to do) and each visa has a biometric chip this:

"Will "kill" ePassport chip functionality"

The only two options that do not present "collision problems" are: Option 4: "visa sticker and separate biometric visa smart card" and Option 5: "visa sticker without chip, biometrics in "D barcode". However, they present new problems if the "biometric Smart-Card is removed from the passport" and they are not "in line with the current draft regulation" - and the draft Regulation would have to be amended.

The same "collision problem" could occur for the chips in residence permits, for example, where multiple visas/entry documents are put in one travel document. One solution for residence permits is to issue them as a separate card - though this presents problems for establishing that the person holding the card is the same person as indicated by a passport.

The Justice and Home Affairs Council (JHA) on 2 December was told that the "timeframe" set by the European Council (the Summit of Prime Ministers), namely that the Regulation should be adopted and technical specifications adopted by the Commission by the end of 2004 could not be met. Perhaps a bit hopefully the JHA Council was told that "a suitable solution should be identified within the first three months of 2005". At the moment this looks unlikely as the discussions in the Commission's "technical" committee shows a four-way split between EU governments as to the best solution. "Some delegations" want to abandon this proposal and wait until the Visa Information System (VIS) is operational (target 2007/8) and then:

"integrating biometrics of visa applicants in the VIS rather than adopting costly solutions which would not bring a biometric solution that much quicker"

The VIS system and database involves the collection of biometrics (photo and fingerprints) and personal data on a visa applicant usually at consulates outside the EU. The biometrics and data will be entered and stored first on national visa databases (N-VIS) and then on a central EU database (C-VIS).

The devil is in the detail - surely the Council knew this would not work?

---

The proposed Regulation to lay down a new uniform format for visas - an estimated seven million a year - would affect visitors from the 132 countries needing visas to visit the EU (list of countries needing visas to enter the EU: List: 2001, pdf).

On 24 September 2003 the European Commission put forward proposals (COM 558) to amend Regulation 334/2002 which in turn had amended Regulation 1683/95. The 2002 amendment - passed as part of the EU Action Plan on terrorism - said that a photograph should be added to the visa. No sooner was the ink dry it was proposed that a"storage medium" (eg: a chip) containing biometrics - a facial image and two fingerprints - should be added too under the new Commission proposal.

The Commission proposal posed a number of obvious questions. The VIS feasibility study carried for the Commission recommended that ten fingerprints should be taken yet the Commission has proposed that just two be taken because of the storage capacity of a contactless chip - greatly increasing the chances of mis-matches - and which can only be used for "one-to-one" checks (verification) not "one-to-many" (that is checking a person against millions on a database).

As to the "facial image" required by the ICAO (International Civil Aviation Organisation) the Commission leaves the choice to member states whether to simply to digitise normal passport photos or to use a real biometric "facial scan" (facial recognition) to plot up up 1,840 characteristics for each individual's face which is then stored via a template on the "chip". The former is again only really useful for "one-to-one" identification and has a high error-rate in a large database.

The cost of the Commission's proposal is quite simply non-existent. Not only have all the finger-prints and quasi-biometrics (digitised pictures) to be collected from millions of people every year through "enrolment" systems but thousands of "verification" systems have to be "design and built", installed and officials trained for every land, sea and air border control point. The cost of the contactless microchips "is not yet known". The overall costs, the Commission concludes, are "rather difficult to specify".

The Commission proposal (COM 558) had been proceeded by a Council Presidency detailed Note on "visa security and controls" dated 24 June 2003. EU governments were asked to respond to the Note, only six did (doc no. 12171/03, dated 8.9.03). However, two governments raised the rather fundamental point that has now been recognised by the rest of them over a year later. Denmark said that there could be "interference" from other chips in the passport and asked what would be the reaction of non-EU states to Schengen states inserting chips in their passports? And, would "this be in accordance with international law"? Poland raised the question of "reciprocal interference that could effectively make impossible to read data included in them", especially as third countries might put their own chips in their citizens' passport.

Despite the obvious problems with the Commission's proposal at the Justice and Home Affairs Council on 27 November 2003 there was "political agreement" on it by the then 15 EU states. The same JHA meeting called on the Commission to set up a committee (under Article 6 of Regulation 1683/95) of member state representatives to lay down the "technical specifications necessary for the implementation of the measures".

The same Note on "visa security and controls" dated 24 June 2003 describes the visa sticker as carrying a chip and an "antenna" (RFID) to "converse with the informatic environment" and states that if any attempt is made to interfere with the chip then "it self-destructs" - an earlier report referred to the chip "exploding".

The Article 6 Committee

---

The Article 6 Committee set up by the Commission created three expert groups:

1. An expert group led by France looked at "how the chip could be integrated into the visa and residence permit sticker"
2. An expert group led by Germany, looked at "what kind of chip"
3. An expert group from the Netherlands looked "necessary hardware"

The group meet several times and presented the results of their work to the full Article 6 Committee on 14 October 2004.

On EU passports the Committee concluded that the technical integration of the chip and the "storage of two biometric identifiers is "technically possible". Interestingly the Committee refers explicitly to the integration of "a Radio Frequency chip" where previously references have been to a "contactless chip" (see: ACLU: RFID and skimming).

The major problem identified concerns visas. The Committee concludes that: "the solution envisaged by the draft regulation (option 1a) is technically not feasible" . This is because of the "collision problem" caused if there is more than one (ie: the EU one) contactless chip "in the same passport".

Moreover, four other options considered (1b, 2, 3 and 3a) "are not technically possible at the current stage of technology".

The expert groups did look at two other options "which were not in line with the current draft regulation" (Options 4 and 5).

Option 4 would mean that there would be a visa sticker in the passport and a separate Biometric Visa SmartCard - a card would be issued with every visa and there would be no "collision" as the card would be checked separately. The problem with this solution would be if a person with a valid passport and visa had lost or forgotten the smart card.

Beyond this point the members states are divided as to how to proceed.

"Some delegations" said the name of the holder would have to be on the card and whether an entirely new "visa-card" could be devised. However, it was pointed out that the time frame was too short to think of having a smart card having all the required security features and would lead to "the whole process of visa issuing" to be reviewed. Option 4 also raised the issue of extra costs for consular posts issuing visas and border control points.

"Two delegations" favoured Option 5, a visa sticker without a chip but with biometric data stored on a 2-D-bar code - this would avoid the "collision" problem but would mean: "the design of the uniform format for visas would have to be completely changed, a complex and time consuming exercise".

And "some delegations" want to wait until the VIS database is operational and to integrate the biometric of visa applicants into this - how this would solve the problem is not clear as there would be no point in holding biometric data about a person on a central database if the person concerned does not have a visa with biometric data to present for checking.

The report does not deal with biometric residence permits at all, which providing they contain only one chip would present no "collision" - unless other chips were attached if the person moves around the EU. It is sobering to note in this context that the idea of creating national and an EU-wide database of resident third country nationals was suggested by Germany in the autumn of 2001 and was rejected by the other member states - only Germany and Luxembourg have registers of all resident third country nationals. Under this proposal all will be registered nationally - leading to the possibility that selected communities could be systematically targeted.

Tony Bunyan, Statewatch editor, comments:

"There is an element of imperial arrogance about the EU visa proposal to insert chips with biometrics in other countries' passports without thinking about whether or not they might want to have a say in the matter.

On top of this biometric chips in passports "kill" access to biometric chips in visas in the same passport, and if other countries decide to insert biometric chips in their visas then the visa chips "kill" each other off. What a fiasco!"

Documentation

---

1. Key document: Technical report to Council saying that the scheme will not work (14534/04, 11.11.04)

2. European Commission proposal (COM 558) (24.9.03)
3. Council Presidency detailed proposal on visa security (doc no. 10857/03, 24.6.03) plus ADD 1 (18.9.03)
4. Responses to Presidency proposal (doc no. 12171/03, 8.9.03)
5. Council proposal on which there was "general agreement" on 27 November 2003 (14969/1/03, 21.11.03)
6. Earlier draft EP report by Sorenson (24.2.04)
7. Second European Parliament report Coelho (adopted by LIBE Committee, 28.10.04)
8. Note to Justice and Home Affairs Council (15256/04, pdf)

9.  Council Regulation laying down a uniform format for visas - consolidated

10. Statewatch, September 2003, when the proposal was announced: EU takes another step down the road to 1984

---

Statewatch News online | Join Statewatch news e-mail list | Search Statewatch database

Statewatch does not have a corporate view, nor does it seek to create one, the views expressed are those of the author. Statewatch is not responsible for the content of external websites and inclusion of a link does not constitute an endorsement.