In 2005, State began issuing e-passports, which introduced an enhanced  design and physical security features. These covers include the computer chip  embedded in the back cover that can communicate using contactless ID  technology. Two separate companies were awarded contracts to supply chips for the  U.S. e-passports. 2). In agreement with ICAO standards for e-passports, State generates and  writes a digital signature on the chip of each e-passport during the  personalization process. State has developed a comprehensive set of controls to govern the  operation and management of the PKI that generates the digital signatures  used to help assure the integrity of the passport data written to the chip. At  that time, DHS had not fully deployed e-passport readers to all primary  inspection lanes at all ports of entry and did not have a schedule to do so. Malicious Code Does Not Pose a Significant Risk to U.S. E-passport Computer Chips or Federal Computer Systems That Read Them

Protections designed into the U.S. e-passport computer chip limit the risks  of malicious code being resident on the chip, a necessary precondition for  a malicious code attack to occur from the chip against computer systems  that read them. GPO and State have taken additional actions to decrease  the likelihood that malicious code could be introduced onto the chip. Finally, given that no protection can be considered  foolproof, DHS still needs to address deficiencies noted in our previous  work on the US-VISIT computer systems to mitigate the impact of  malicious code, should it infect those systems. While these steps do not provide complete  assurance that the chips are free from malicious code, the limited  communications between the e-passport chip and agency computers  significantly lowers the risk that malicious code that could be resident on  an e-passport chip could pose to agency computers. Without these capabilities, the  additional security against forgery and counterfeiting that could be  provided by the inclusion of computer chips on e-passports issued by the  United States and foreign countries, including those participating in the  visa waiver program, is not fully realized. GPO and State have also taken steps to assure the security of the  embedded computer chips in U.S. e-passports. Recommendations for Executive Action

To ensure that border officers can more fully utilize the security features  of electronic passports, we recommend that the Secretary of Homeland  Security take the following two actions to provide greater assurance that  electronic passport data were written by the issuing nation and have not  been altered or forged:    Design and implement the systems functionality and databases needed to  fully verify electronic passport digital signatures at U.S. ports of entry. To determine whether malicious code on the e-passport chips poses a risk  to national security, we determined how U.S. e-passport computer chips  are manufactured and incorporated into the production of blank U.S.   e-passport booklets based on interviews with the Government Printing  Office (GPO) and manufacturer officials and our reviews of GPO  documentation.
Why GAO Did This Study

In 2005, the Department of State (State) began issuing electronic passports (e-passports) with embedded computer chips that store information identical to that printed in the passport. By agreement with State, the U.S. Government Printing Office (GPO) produces blank e-passport books. Two foreign companies are used by GPO to produce e-passport covers, including the computer chips embedded in them. At U.S. ports of entry, the Department of Homeland Security (DHS) inspects passports. GAO was asked to examine potential risks to national security posed by using foreign suppliers for U.S. e-passport computer chips. This report specifically examines the following two risks: (1) Can the computer chips used in U.S. e-passports be altered or forged to fraudulently enter the United States? (2) What risk could malicious code on the U.S. e-passport computer chip pose to national security? To conduct this work, GAO reviewed documents and interviewed officials at State, GPO, and DHS relating to the U.S. e-passport design and manufacturing and e-passport inspection systems and procedures.

What GAO Found

State has developed a comprehensive set of controls to govern the operation and management of a system to generate and write a security feature called a digital signature on the chip of each e-passport it issues. When verified, digital signatures can help provide reasonable assurance that data placed on the chip by State have not been altered or forged. However, DHS does not have the capability to fully verify the digital signatures because it has not deployed e-passport readers to all of its ports of entry and it has not implemented the system functionality necessary to perform the verification. Because the value of security features depends not only on their solid design, but also on an inspection process that uses them, the additional security against forgery and counterfeiting that could be provided by the inclusion of computer chips on e-passports issued by the United States and foreign countries, including those participating in the visa waiver program, is not fully realized. Protections designed into the U.S. e-passport computer chip limit the risks of malicious code being resident on the chip, a necessary precondition for a malicious code attack to occur from the chip against computer systems that read them. GPO and State have taken additional actions to decrease the likelihood that malicious code could be introduced onto the chip. While these steps do not provide complete assurance that the chips are free from malicious code, the limited communications between the e-passport chip and agency computers significantly lowers the risk that malicious code--if resident on an e-passport chip--could pose to agency computers. Finally, given that no protection can be considered foolproof, DHS still needs to address deficiencies noted in our previous work on its computer systems to mitigate the impact of any malicious code that may be read from e-passport computer chips and infect those systems.