Seven percent of GDP was lost to fraud in 2008, according to the US Association of Certified Fraud Examiners. That’s $994 billion a year. But new technology can significantly protect against forged documents such as checks, certificates or passports.
In 2001, a study by the secure document supplier Standard Register found that commercial checks were attacked at an average rate of nearly one in every 1,000 items. Further studies showed that the rate of attack on checks with two or more security technologies was better than one in 100,000.
Standard Register responds to the threat of forgery by using an arsenal of methods. These include the use of special inks and toner adhesives which prevent documents from being changed, and manufacturing its own paper to ensure that no-one else can get at it. This is done via copy protection systems such as Void pantographs (a pantograph screen with the word ‘VOID’ hidden in it), watermarks or microprinting.
The main challenge is ensuring that the recipient of a document examines it carefully. Standard Register suggests that instructions for how to examine a document might be printed on the document itself.
Another approach, adopted by the British company Ingenia Technology, uses a technology called Laser Surface Authentication (LSA) developed by a team at Imperial College London under Professor Russell Cowburn. It exploits the fact that every document—whether paper, plastic, metal or cardboard—has a unique identity due to microscopic imperfections in its surface. By scanning the surface, a code can be generated which can be used to identify the document, whether it’s a share certificate, an identity card, a packet of pills or a carton containing a television. The code has either to be stored on a central database or sent with the document in the form of an encrypted barcode.
The code is robust. According to an article by the team in the journal Nature in 2005, documents were screwed into a ball and then flattened, submerged in water and dried, baked, scribbled over, or scrubbed with an abrasive pad, and still the code could be recognized.
And the authors point out that their technique involves no proprietary manufacturing process: “Even the inventors would not be able to carry out a physical attack on this fingerprint as there is no known manufacturing process for copying surface imperfections at the required level of precision.”
However, while LSA may guarantee the authenticity of the document, it cannot guarantee the authenticity of the information it carries, as embedding contactless technology (RFID) in the document does. RFID seems to have turned into the system of choice for such purposes, with e-passports and e-identity cards already being rolled out in several countries.
Two HID Global companies, Aontec in Galway, Ireland, and HID Global’s plant in Erfurt, Germany, employ different technologies to manufacture the chip module plus antenna for use in e-documents.
The chips include traditional passport information, but they can also include information such as fingerprints. The level of technical protection depends on the sensitivity of the data; at the least, the passport’s Machine Readable Zone (MRZ) must be swiped before the basic electronic information (name, date of birth, picture, etc.) becomes available. A static key extracted from the MRZ ensures this Basic Access Control protocol.
Starting in June 2009, the EU will make fingerprints in passports mandatory, and, as Marc Bielman, Vice President of Global Production & Sourcing for HID Global, says, “It will be necessary to use more secure Extended Access Control protocols, with authentication and encryption comparable to legally binding electronic signatures. Only authorized readers will have access to fingerprint data and each country will have to provide decryption keys to countries with authorized access.”
As it is, RFID provides a complementary layer of security. “A passport used to have ultraviolet ink and a stamp across the corner of the photo,” says Bielmann. “Then there was a plastic page with a digital picture, then the name was laser engraved, and the next step is RFID. You now have to compare the picture in the passport with the picture on the chip and the real person in front of you.” And the increased security comes with increased convenience. “Already in some airports using e-passports you can get through the border in 45 seconds,” says Bielmann.
None of these technologies will turn out to be foolproof, and the forgers are certainly already working on new ways to work around them. But they all help to ensure that our identity is better protected, and that the document we hold in our hands is what it says it is.