New biometric passports can be cloned using £100 equipment sold over internet17.11.06
A simple microchip reader can clone the information from a passport.
Passports which have rocketed in value to make them more secure can be easily cloned using a microchip reader bought over the internet for less than £100.
The revelation is a huge embarrassment for the Home Office, which has increased the cost of travel documents by 60 per cent in less than a year.
The rise to £66 paid for the introduction of a supposedly-secure biometric chip on the passport, containing the owner's personal details and an image of their face.
The idea was to make it harder to produce a copy of a person's travel document.
But it has now emerged that a simple microchip reader, purchased from the Internet for £95.73, can clone the information - including the photograph.
It could then be used to produced an exact replica of the travel document, complete with a new microchip.
Opposition MPs called for the three million biometric passports issued since March this year from the Home Office's new £60m production lines to be recalled.
Nick Clegg, the Liberal Democrat home affairs spokesman, said: "Three million people now have passports that expose them to a greater risk of identity fraud than before.
"We need an urgent redesign of the biometric passport and a recall of all insecure passports once a new protected design is available."
The fiasco was exposed by the NO2ID campaign, which is concerned similarly poor security will dog the Government's £5 billion ID cards scheme.
They enlisted computer expert Adam Laurie to write a piece of software to suck such data from the chips - a task which took just 48 hours.
The software was then attached to the microchip reader, bought-legally from a UK-based company and dispatched within only four days. Three passports were then stripped of their data, which was loaded on to a laptop computer.
NO2ID said the Government had encrypted the data on the microchip to stop it being stolen - but had made basic mistakes.
Instead of producing a complicated code - the sequence of electronic numbers and letters which unlocks access to the information on the chip - they had simply applied a minimum set of rules published by the International Civil Aviation Authority.
These state the code should include the holder's passport number, date of birth and the document's expiry date - all of which would be clearly visible over the shoulder of somebody preparing to show it to a border guard.
The chip reader, once it knows the code, then has open access to steal the data which it contains.
Mr Laurie said: "The Home Office is using strong cryptography to prevent conversations between the passport and the reader being eavesdropped, but they are breaking one of the fundamental principles of encryption by using non-secret information published in the passport to create a 'secret key'.
"That is the equivalent of installing a solid steel front door to your house and putting the key under the mat."
Gus Hosein, an expert in information systems at the London School of Economics, said: "This is stupid technology. If chips can be cloned they will be used in counterfeit passports."
Phil Booth, of NO2ID, added: "The government is clearly derelict in its duty to protect the privacy and security of British citizens."
The Government opted to introduce the biometric passports after the US authorities - in the wake of September 11 - demanded new security measures on travel documents. Without the changes, any Briton wanting to travel to America would require a visa, causing chaos for millions of holidaymakers.
But it has since decided to make the passports the cornerstone of the ID card project, which is due to begin in 2008 or 2009.
As a result, the cost of a new passport has increased from only £42 in December 2005 to £66. The Home Office said cloning the chip 'doesn't matter'.
A spokesman said: "The information itself cannot be altered; the photo would still be the same so the copy would be of no use to an impersonator trying to use it fraudulently.
"Other than the photograph, which could be obtained easily by other means, they would gain no information that they did not already have - so the whole exercise would be utterly pointless."