• Home /
• News /
• 2005 /
• July /
• Statewatch News Online: EU: ID cards, passports and biometrics

Statewatch News Online: EU: ID cards, passports and biometrics

28 March 2012

EU: Biometrics - from visas to passports to ID cards

- The EU does not have the powers to introduce biometrics for national ID cards
- The ICAO standard only requires a "facial image"
- USA not intending to introduce biometrics on its passports - only a digitised normal passport photo

This analysis as a pdf

---

On 11 July the UK Presidency of the Council of the European Union (the 25 governments) put forward a proposal that all ID cards in the EU should have biometrics (EU doc no: 11092/05 (pdf). See: UK Presidency proposes that all ID cards have biometrics - everyone to be fingerprinted

The document says that this is to meet ICAO standards (International Civil Aviation Organisation, a UN body). But does the ICAO say that fingerprints must be included on passports?

The European Commission's "Article 6 Committee" is charged with drafting "common security standards for national identity cards", in particular the "use of biometrics". But what is the "Article 6 Committee" and what powers does it have?

And how is the USA responding to the ICAO standards - it is going to fingerprint all passport holders?

---

Does the EU have the power to impose biometrics in national ID cards?

The striking factor is that under the current EC Treaty, there is no competence to harmonise ID cards, according to Article 18 EC. So how can a committee established to deal with harmonising visa formats and residence permit formats take up the task of adopting harmonised rules for ID cards? And how can the other issues listed in the UK paper be addressed at EU level?

And just as the UK government is trying to get through ID cards in the UK, the UK as the Presidency of the Council is trying to push through biometric ID cards across the EU - even though the EU lacks competence to introduce such laws.

The Nice Treaty, December 2000, amended Article 18 of Treaty establishing the European Communities (TEC) says:

"Provision facilitating the exercise of the right of citizens of the Union to move and reside within the territory of the member states

Article 18 TEC

1. Every citizen of the Union shall have the right to move and reside freely within the territory of the Member States, subject to the limitations and conditions laid down in this Treaty and by the measures adopted to give it effect.

2. If action by the Community should prove necessary to attain this objective and this Treaty has not provided the necessary powers, the Council may adopt provisions with a view to facilitating the exercise of the rights referred to in paragraph 1; the Council shall act in accordance with the procedure referred to in Article 251.

3. Paragraph 2 shall not apply to provisions on passports, identity cards, residence permits or any other such document or to provisions on social security or social protection."

Article 18 "enshrines" one of the four "fundamental freedoms" of the European Union, namely the right to move and reside in any member states without being checked in doing so. The Article explicitly precludes adopting provisions on "passports, identity cards, residence permits or any other such document".

Yet in December 2004 the EU adopted a proposal to introduce biometric passports, under another doubtful power, a power which at that point only allowed for the European Parliament to be "consulted" (not the co-decision process in Article 251 mentioned in 18.2): See Statewatch EU governments blackmail European Parliament into quick adoption of its report on biometric passports and EU biometric passports and mandatory fingerprinting: Statewatch analysis questions legality of Regulation

The General Affairs Council adopted Regulation on mandatory facial images and fingerprints in EU passports at its meeting in Brussels on 13 December 2004: Full-text (pdf) After the Regulation was published in the Official Journal an "Article 6" Committee was to be set up by the European Commission with representatives from 22 members states (excluding Ireland, the UK and Denmark). This committee is charged with deciding on the "details" such as how many fingerprints are to be taken, the equipment needed and the costs.

"Article 6" Committee

Why is the "Article 6" Committee set up to look at visas then biometric passports too now being asked take on biometric ID cards as well?

Well, this a bit complicated. The "Article 6" Committee referred to was actually set up to deal with the technical aspects of a "Uniform visa format" in 1995, see Regulation 1683/95 (pdf). It is a committee: composed of the representatives of the Member States and chaired by the representative of the Commission - to deal with a "Uniform visa format". For background see: EU: Biometric visa policy unworkable, January 2005. However, Article 6 of Regulation 1683/95 was amended by Regulation 334/2002 which states:

"Article 6 shall be replaced by the following:

"Article 6

1. The Commission shall be assisted by a committee.

2. Where reference is made to this paragraph, Articles 5 and 7 of Decision 1999/468/EC (*) shall apply.

The period laid down in Article 5(6) of Decision 1999/468/EC shall be set at two months.

3. The Committee shall adopt its rules of procedure."

So what do Articles 5 and 7 of Decision 1999/468 say? The Decision sets out procedures for the implementing powers conferred on the Commission. Article 5 and 7 give the European Parliament the right to get agendas, minutes and draft proposals before any committee where the "basic instrument" is adopted under Article 251 - that is, the co-decision procedure where the Council and the parliament have to agree (as distinct from the "consultation" procedure where the parliament's views can be and are usually ignored).

Where does this leave us? The "basic instrument" is Regulation 1683/95 on "Uniform visa format" which was adopted under the "consultation" procedure - therefore the parliament has no powers nor the right to information.

But as the "basic instrument" concerns the "Uniform visa format" what powers are there for the "Article 6" Committee to have its remit extend first to residence permits for third country nationals, then to passports and now to national ID cards as well?

At the beginning of 2004 the Committee was considering biometric features of visas and residence permits. At is February 2004 meeting three expert groups were set up: 1. An expert group led by France looked at "how the chip could be integrated into the visa and residence permit sticker"; 2. An expert group led by Germany, looked at "what kind of chip"; 3. An expert group from the Netherlands looked at the "necessary hardware".

The meeting of the Committee on 28 October 2004: considered the "Integration of biometrics in passports: Preliminary draft of technical specifications" - the European Parliament plenary session did not adopt its report until 2 December and the Council did not adopt the measure until 13 December 2004.

At the meeting on 13 May 2005: "The Commission informed delegations of the informal meeting held in Brussels on 18.4.05 on identity cards". Then on 11 July the UK Presidency issued its Note on "Minimum common standards for national identity cards" which included giving the Article 6 Committee the task of drafting "common security standards for national identity cards" including the "use of biometrics".

The UK Note and other EU documents on these issues are liberally sprinkled with references to "ICAO standards" as if these require the EU to collect fingerprints for passports.

What are ICAO standards?

This begs a fundamental question as the ICAO standard (document 9303) says:

"Facial recognition was selected as the globally interoperable biometric for machine-assisted identity confirmation with MRTDs [Machine Readable Travel Documents]"

The basic description by the ICAO refers to a "facial image" being included in a passport. These terms, "facial recognition" and "facial image" can mean the same thing or something quite different. The inclusion of a "facial image", allowing for "facial recognition", can be met by the digitisation of current passport photos - this is not a biometric. Biometrics involve the "capturing" of unique physical features from an individual, that is, by taking a "facial scan", fingerprints or an "iris scan".

As the Head of the UK Passports Service said in a recent interview with the Financial Times:

"The facial biometric can be implemented with minimal change to the image capture (i.e. photo boots) and application process. The technology is eminently suitable for border control checking. It enables immigration officers to produce an image of the passport holder for checking the authenticity of the document against the person."

"Facial recognition" can also refer to "facial scan" which is a biometric (the scan collects up to 1,840 unique characteristics from each individual's face).

A "facial image" not fingerprints were selected as the global standard by the ICAO - fingerprinting is an optional extra at the discretion of national state.

ICAO on document 9303 also says:

"Doc 9303 specifications allow the coexistence of technologies including those for bar codes, magnetic stripes, integrated circuits with contacts, contactless integrated circuits, optical memory to co-exist on the document along with OCRB. These are "optional"
technologies, to be used at the discretion of the State or organisation issuing the MRTD, and as appropriate to specific documents issued."

The ICAO standard for passports and travel documents thus allows for the "coexistence of technologies".

As the ICAO was setting a standard which could be applied internationally it had to take account of the level of technology available to all countries in the world. Every passport or travel document has to be:

1. A MRTD, a machine readable travel document, which includes on a bar code, magnetic stripe or RFID (Radio Frequency ID) contactless chip both the details of the individual (name, date of birth etc) plus

2. A "facial image" which can simply be a digitised image of the normal passport picture (taken in a photo booth) or a biometric "facial scan".

Most countries in the world will opt for digitising the normal passport photo, partly for reasons of cost and partly because the taking of a "facial scan" requires the physical presence of the individual at an "enrolment centre".

The difference between the two approaches is crucial.

The inclusion of the minimum necessary ICAO standard, can be met by digitising the normal passport picture which:

a. is simple and relatively cheap;
b. does not require the individual to physically attend an enrolment centre;
c. does not involve the compulsory taking of biometrics;
d. allows "one-to-one" (verification) checks at point of entry (eg: airport, seaport or land border) to confirm that the person presenting the passport is the same as the details recorded;
e. does not necessarily involve the creation of national databases. Digitised photos have a high error rate if used for "one-many" (identification) checks, for example checking one person's photo against 50 million.

The collection of biometrics involves facial scans and/or fingerprinting whether for passports or ID cards:

a. requires the physical presence of the individual at an "enrolment centre";
b. an "interview" where the individual has to prove they are who they say they are. This is so that biometric documents, which are intended to be infallible, are not issued to people using another name - though a diligent fraudster could construct a plausible "identity" based on a real person;
c. the compulsory taking of biometrics, facial scans and fingerprinting;
d. the costs of interviews, taking biometrics, issuing RFID contactless chip plastic cards, creating national databases and installing "reading systems" at entry points is unknown - the EU does not even know how many passports and ID cards have been issued at national level.
e. will involve "one-to-many" (identification) checks against national databases containing millions of records - there will be errors even with biometrics and the error rate will grow at the size of the database grows and may vary from country to country depending on the technology;
f. plans are already afoot to extend the planned SIS II (the Schengen Information System) to include this data and, where available, DNA data (how long will it be, once the new system is in place, that the compulsory taking of another biometric, DNA, will be added to facial scans and fingerprinting?)
g. and while the data and biometrics will be collected for the purpose of establishing identity when issuing passports and ID cards it will end up being accessible to all law enforcement agencies.

EU and UK passports

When the UK starts to "interview" passport applicants (starting with first-time adults) from the autumn of 2006 they will be subjected to a "facial scan" with fingerprinting following later. The government's planned ID card system would mean that everyone getting a new passport would automatically be issued with an ID card as well.

For the EU the "standard" is:

"Passports and travel documents shall include a storage medium which shall contain a facial image. Member States shall also include fingerprints in interoperable formats. The data shall be secured and the storage medium..."

The EU's passport specification document states that the facial image "shall be derived from the passport photo" and stored on the chip as a "compressed image file" (JPEG). The "secondary biometric - fingerprints" require the taking of prints from two fingers. See: EU biometric implementation (pdf)

The EU is now just starting to consider the "reading systems" that will be needed at "border control points" (EU doc no: 10559/05). The timetable is set as: incorporating the "facial image" on the chip for newly-issued passports by 28 August 2006 - sufficient to meet the ICAO standard. When the details for adding fingerprints is agreed the 25 member states will have three years to comply. Again the document confusingly refers to "facial image biometrics" when talking about digitised passport pictures.

While most EU member states have in place the equipment to check the "machine readable zone" on the passport page they will also have to get "Basic Access Control (BAC)" machines to "access chip data". A questionnaire has been sent out to governments asking what checks and what equipment they intend to install. This asks whether existing reading systems are linked to the SIS or to "national suspect/warnings databases" and do they intend to carry out "one-to-one" checks or "one-to-many" or both. It asks too whether the check will be "simply a process" of looking at the image stored on the chip for a "manual comparison" or will there be a "full verification process" comparing the stored images on the chip with "live captured images from the person presenting the document?

In October 2005 "technical reprentatives" from Canada and the USA will be attending a meeting of the EU's Frontiers/False Documents working party to discuss "reading" projects.

How is the USA responding to the ICAO standard and biometric passports?

The USA is intending to introduce a 64kb contactless chip with a read distance of only 4 inches. This will carry personal details already on passports plus a "facial image" which will be the normal passport "photo in a digitised format". Border official will "compare the passport bearer with the digital facial image stored on the electronic chip".

The USA will not be encrypting the data as this takes longer to read and would not be "globally interoperable" as:

"encryption would require a higher level of technology and more complicated coordination with other nations".

The USA is thus not going to introduce passports requiring the taking of biometrics. It is going to introduce digitised facial images of passport photos on a chip in passports allowing "one-to-one" checks to be carried out - which will effectively meet not just the ICAO standard but also be "globally interoperable". The EU will do the same but also collect the fingerprints of every passport or ID card holder - the latter only being capable of checks in countries having same technology. The system for border controls blur into a system for identity checks.

Tony Bunyan, Statewatch editor, comments:

"Again it has to be asked: Why is the EU seeking to take such a giant step of collecting everyone's fingerprints. The cost is unknown both for passports and ID crds, the legal basis of both is highly dubious, the technology is untested, there are no standards or costs for the thousands of border control points (air, sea and land) and they are no data protection provisions in place.

But, as important as all of these questions put together, is to ask: Can a pluralist, diverse and tolerant democratic culture survive when the state can fingerprint the whole population and place under surveillance every movement and every communication?"

Background

1. National ID cards, EU doc no: 11092/05 (pdf)
2. UK Presidency proposes that all ID cards have biometrics - everyone to be fingerprinted
3. EC Regulation on mandatory facial images and fingerprints in EU passports: Full-text (pdf)
4. EU biometric implementation (pdf)
5. European Parliament urged to reject biometric registration of all EU citizens and residents
6. EU governments blackmail European Parliament into quick adoption of its report on biometric passports
7. EU biometric passports and mandatory fingerprinting: Statewatch analysis questions legality of Regulation
8. ICAO: doc 9303
9. ICAO Technical Reports
10. John Lettice, the Register: UK EU presidency aims for Europe-wide biometric ID card (link)

---

Statewatch News online | Join Statewatch news e-mail list | Search Statewatch database

Statewatch does not have a corporate view, nor does it seek to create one, the views expressed are those of the author. Statewatch is not responsible for the content of external websites and inclusion of a link does not constitute an endorsement.