Slashdot Mirror
US Border Officials Haven't Properly Verified Visitor Passports For More Than a Decade Due To Improper Software (zdnet.com)
An anonymous reader quotes a report from ZDNet: U.S. border officials have failed to cryptographically verify the passports of visitors to the U.S. for more than a decade -- because the government didn't have the proper software. The revelation comes from a letter by Sens. Ron Wyden (D-OR) and Claire McCaskill (D-MO), who wrote to U.S. Customs and Border Protection (CPB) acting commissioner Kevin K. McAleenan to demand answers. E-passports have an electronic chip containing cryptographic information and machine-readable text, making it easy to verify a passport's authenticity and integrity. That cryptographic information makes it almost impossible to forge a passport, and it helps to protect against identity theft. Introduced in 2007, all newly issued passports are now e-passports. Citizens of the 38 countries on the visa waiver list must have an e-passport in order to be admitted to the U.S. But according to the senators' letter, sent Thursday, border staff "lacks the technical capabilities to verify e-passport chips." Although border staff have deployed e-passport readers at most ports of entry, "CBP does not have the software necessary to authenticate the information stored on the e-passport chips." "Specifically, CBP cannot verify the digital signatures stored on the e-passport, which means that CBP is unable to determine if the data stored on the smart chips has been tampered with or forged," the letter stated. Wyden and McCaskill said in the letter that Customs and Border Protection has "been aware of this security lapse since at least 2010."
MY BALLS!!! Suck 'em, nerds!
How much do you want to bet that they were able to get a "solution" budgeted every year?
Mod me down with all of your hatred and your journey towards the dark side will be complete!
This episode of security theatre is brought to you by CBP (Customs and Border Patrol) part of the larger circus called the DHS (Department of Homeland Security) which is now the largest federal law enforcement agency. We can't figure out if your passport is legit but take off your shoes and don't even think of taking those nail-clippers or toothpaste on that airplane. Someone should start a Dilbert-like DHS comic strip and make T-Shirts we people can wear when going through security.
When was Obama sworn in? Wow. The more new DNC voters the merrier. Right? Need to breed out those pesky christian conservative americans at all cost.
Now everyone knows about this and now fake passports will accompany people using fake identities because they know nobody is checking the authenticity of the passports. Thanks a lot, blabbermouth!
So what happened when a request was made to a chip What did the GUI say for a many years?
No error, allow the passport?
The same cryptic error code for every valid passport?
No error code for every illegal "migrant" trying a "passport"?
Domestic spying is now "Benign Information Gathering"
but all I feel is sadly unsurprised. After a while some people just cant live up to your expectations or their own.
Always blaming Trump for everything.
Who was US president during most of this time?
You Maniacs! You blew it up! Ah, damn you! God damn you all to hell!
The idiot-in-chief wants to build a wall while there are massive issues like this with the existing system. Fixing this problem would obviously be more effective than a stupid wall. How on earth did we end up with such a moron in the Presidency?.
Incompetence. I know! Let’s put them in control of our health care!
All of those passport checkers may as well have stayed home for the past ten years.
Kriston
There was an interesting e-passport replication technology reported at the "Black Hat" security conference in 2006 So far as I know, this replication approach has never been disabled
https://www.theregister.co.uk/...
RFID chips are, by their nature, kept very inexpensive and easy to read. Unless the USA and other nations are prepared to invest in more powerful and secure standards for what is supposed to be a very easily scanned and robust technology, I'm afraid that I don't see how they can be made more secure.
I need to see your papers. Are they in order?
What did the computers say?
All passports looked at got a correct pass every year?
Nobody thought to have a failed passport test at random times to see if every computer GUI was working?
Every passport failed and the GUI was always ignored. Waiting for an update to finally get the functionality?
An error code did show but it always had to be scrolled past with many other messages?
Domestic spying is now "Benign Information Gathering"
I can't wait until the government takes over our healthcare. They have proven time and time again that they are the best at managing important services.
We need more of this wonderful government managing as many aspects of society and as much of our lives as possible! What could possibly go wrong?
Comment removed based on user account deletion
Comment removed based on user account deletion
Replication has SOME value, but being able to change the contents without it being spotted is the money play here.
And the major players had to know already.
Want to slip a couple of Russians in ?. Edit a couple of stolen or otherwise clean passports and there you are comrade.
I'd guess something like that was uncovered during other investigations probably triggered this.
And in that time, the number of terrorist attacks by foreigners sneaking into the country is...zero.
Maybe that "foreign terrorist" threat isn't nearly as bad as we were told? Maybe we have more to worry about from other Americans than we do foreign terrorists?
You are welcome on my lawn.
This is just another of the many ways in which the United States has become the stupidest country on Earth.
area. It is the ccomunity at what we've known as it is licensed
no one in so called law enforcement should be out of prison, Solitary for all of them is appropriate, these are people that are traitors and murders so....
I know, right? After that, the government will probably want to take over the military, with enough nuclear weapons to destroy humanity. What could possibly go wrong, amirite? And border security. Thank goodness we live in a free country where the government isn't in charge of something as important as border security or national defense.
We need to act now to keep the government's hands off our military, don't you agree? Yeah, you. Dummy. I'm talking to you.
You are welcome on my lawn.
Once again a gross failure of the Obama administration to implement US law is revealed. Though it's not like Obama had any interest in protecting the borders; he was too much invested in being "flexible" with Russia. And of course now the Dims are in hurry-up mode to get Trump to work on fixing Obama's screwups.
Not just some US agencies. Because the EU joined in, every EU citizen had their passports "upgraded" with the rfid/nfc malarky, whether you wanted it or not. (The Swiss at least get a choice. EU citizens do not.) When people demanded built-in sleeves like you got, they didn't get it, so all EU passports are leaky.
In fact, because "identity cards" were legally equated with passports, those got the chips too. And just about every EU country then forced every citizen to always carry an ID card. With rfid chip and fingerprints. Without shielding sleeve. Because now we have "open borders", sold to us so we wouldn't need a passport at the border, we now have to have rfid ID cards on us at all times. That's three hundred-odd million people stuck with rfid ID cards. No it's not entirely the US' fault, but your out-of-control government just provided our US-sycophant overlords with the convenient excuses. Thanks for that, I guess.
The thing of course is that this rfid shit doesn't do a thing to make passports safer, in fact it makes them less safe and less secure. But the real problem isn't with the rfid cards. It's with the asylum^Wfortune seekers that come in on stolen blank Syrian passports and other such not entirely honest people that are doing their level best at swamping us. When the rulemongering idiots at immigration "cannot prove" such people have ill intentions, "there is no problem", so they're let in. And issued valid EU papers, complete with valid EU digital signatures and everything. And that's just one small example.
Digital signage and rfid chips are yet another techno-circle jerk that ultimately doesn't do squat to make anyone more secure or safer. I for one would be much happier with an rfid-free passport and no rules mandating ID cards.
"Cryptographic information" sounds like information about encryption. Do they mean "encrypted information"?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Why are democrats complaining about this? Dont they want to get rid of all barriers to entry such as walls and such?
And yet the Democrats keep blocking every attempt to verify a voter's real identity. Heck, these people could just show a (fake) passport everywhere they vote.
The software they use was supplied by Oracle. It's okay, they logged a bug ticket when they noticed the problem. I'm sure it'll be fixed soon ;-)
It's because congress, and even state legislatures don't have the vision to see that software and training might be necessary. And a bloated enterprise like Homeland Security and TSA - well they can just barely do security theater. So while a legislative body might pass a feel good that the electronic encryption on a passport is secure - they completely forgot about funding to develop the software to read it.
Don't worry everyone, APK will be along shortly to tell us how using hosts can solve this security problem. If you question him he will call you a ne'er-do-well or a soros funded puppet, then state that he won.
First of all, which Bush?
It doesn't matter. Both of them substantially expanded the number of government jobs during their administrations.
Second, exactly what "private" (in your view) industry did he "socialize?"
All airport security was private contractors prior to 9/11. Then it became a part of DHS. More generally public sector payroll expanded greatly during their administration - more than most recent presidents except perhaps Clinton. Based on their actions it's not entirely irrational to say they are closeted socialists.
Third, are you seriously claiming that Bush (41 or 43) is a socialist?
Oh they try to pretend they aren't but it's actually pretty easy to argue that a lot of republicans are really socialists in denial about it. They want big government and if you mute their rhetoric their actions prove it. They never actually cut military spending, medicare spending, or social security which are the three biggest line items in the federal budget. In fact Bush 43 expanded medicare and every republican administration tries to make the military larger to pander to their base. So yeah, they kind of are a weird sort of socialist.
But the people who convinced the government to buy their ePassport technology are very happy with their results. Who cares if it works, just pay us!
that these Dems who wrote this letter care. After all, the Dems rely on a stream of illegals coming across the border anyways.
Nobody wanted a secure border ... nobody who mattered, anyway. No wonder stuff like this got to slide.
Until, mysteriously, now. Must be those darn xenophobe rubes who took over ...
Who would have thought there was a valid excuse to put a hold on immigration so that the system could be reviewed?
The wording on the language in the Request For Proposals is nearing completion.
Relax peoplre, gubberment is on it!
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
See subject & I see you're still butthurt I cornered you for your bs lie you can't backup https://it.slashdot.org/comments.pl?sid=11776765&cid=56174209/ you obsessed lunatic!
* I loved how you had to EVADE backing up your bullshit that "2 billion people depend on your 'work'" bullshit & your "work" is trolling (no, they do NOT depend on your trolling as it's not an actual useful program like mine that even /.ers use & like)!
HOWEVER, I must admit - I truly DO depend on YOU - how? I depend on YOU to always make ME look GOOD & yourself like the lying bullshitter you proved you are, lol!
APK
P.S.=> GROW UP... apk
Does anyone remember passports before they were chipped? I do. They looked exactly like the new chipped passports do.
My point is, a forged passport was potentially a problem then just as it is now. I'm not sure our level of risk has greatly increased.
On the other hand! With chipped passports being available for a number of years, it seems like DHS would have been a little more interested in the chip readers. After all someone felt that the passports would be better with chips in them, and by "someone" I mean people important enough to make that happen, and lots of them. This isn't some kind of small-time initiative you can throw together in a weekend in your backyard.
So it's not a pants-on-fire emergency. It sounds a little more like standard bureaucratic foot dragging.
Cue Trump blaming Obama for the problem in 3... 2... 1...
I've abandoned my search for truth; now I'm just looking for some useful delusions.
As a nonAmerikan I was told my well travelled 7 year old passport was "insecure" and "wouldnt be compliant with our new security measures" so I had to spend $200 and no small amount of time getting a new chipped one. Which they never actually scan.
But you can still buy a good fake US passport in China for $100...
Is not government awesome? Consider:
Just recall the above (incomplete) list next time someone suggests, yet another industry/market would be better served by the caring and omniscient government employees, than by the greedy KKKorporations.
In Soviet Washington the swamp drains you.
Maybe you should worry less?
Naw. Thats for brave free peoples, not you bigly people.
Really? That's the best comeback you've got? Nuclear weapons? I won't stupe to your level by calling you dirogitory names, but here I am arguing that government should not be in charge of health care because thay take forever to get things done, and health care needs quick reactions, and you try and lump in nuclear weapons into the same category? I for one want them to take a long time to decide to launch nuclear weapons. If you want them to launch them faster then good luck with that. A world where we launch weapons with the speed that we need in healthcare would not be a great place to live in.
The prosecution rests.
You are welcome on my lawn.
...that wall rather than spending just a tiny fraction of that amount of money on passport scanning software.
#MAGA