Interior Minister Roumen Petkov’s presentation of the six companies that will be competing for the production of Bulgaria’s new biometric passports brought no clarity as to what biometric data is going to be stored on the chip in the passports or how the  passport holders privacy would be protected. The new passports are to be introduced before the end of the year.

At a news conference on March 25, Petkov listed the steps taken so far towards the introduction of the new passport. A long list of decisions taken at various levels of government, committees set up, work done and documents produced by these committees, leading to further decisions taken by deputy ministers at the Interior, Foreign Affairs, Finance, Transport and other ministries was summed up. All this led to a Cabinet decision on July 26 2007 to announce a public procurement tender to select the company that would make the country’s new biometric passports. In October 2007, the interior ministry formed a committee to research 52 companies. The committee shortlisted 12 companies who were invited to participate in the tender and 10 of them bought the documentation for participation in the tender. When the deadline passed, six companies had filed offers, Petkov said.

The six companies competing for the tender are Siemens Bulgaria, Hungarian Allami Nyomda Nyrt, German Bundesdruckerei Gmbh, French Sagem Defence Securite, Greece’s Printec and French Gemaldo.

A new committee with representatives from the Interior Ministry, State Agency for National Security (SANS) and the State Administration Ministry is expected to select the winner by early May. Contracts are expected to be signed before the end of May, Petkov said.

Bulgaria’s new passport plans follow European Union plans for EU-wide issuing of biometric passports. The European Commission (EC) adopted in 2005 and in 2006, specified plans to include a facial image and two fingerprints of the passport holder on a contactless chip. The proposal exempted children aged under six and people who are physically unable to give fingerprints.

Internationally accepted standards for biometric passports have been set by the International Civil Aviation Organisation (ICAO), the same organisation that has defined the currently used machine-readable passport standard.

Of the EU member states that have introduced biometric passports only Germany has scans of two fingerprints added to the chip.

The EC also proposed the creation of a centralised database to store fingerprints and other biometric data.

The long and detailed list of achievements so far, announced by Petkov, included one glaring omission; there was not a word about what biometric data would be stored on the chip in the new passports. When asked by The Sofia Echo, a spokesperson for the Interior Ministry said that the data stored would include what is on the personal information page in current passports. This would include a photo, the names of the owner of the passport, date and place of birth and EGN (Bulgarian social security number), among others. However, none of these are considered biometric data. The ministry spokesperson said it was unclear if fingerprints or other biometric data would be included on the chip, adding that this would probably be announced after the production details has been finalised and the contract for the production of passports has been signed.

Bulgaria’s new passports will be centrally issued in a new purpose-built facility, but Petkov carefully avoided any mention of whether or not the data stored on passports would also be stored in a centralised database.

The day after Petkov’s announcements, Peter Hustinx, head of the European Data Protection Supervisor (EDPS), presented an opinion in which he criticised the EU plans for biometric passports and the creation of centralised databases by member states. The plans did not sufficiently protect the rights of citizens, Hustinx said. “They fail to address all the possible and relevant issues triggered by the inherent imperfections of biometric systems, and more specifically, those related to children and the elderly.”
Fingerprints from children and the elderly are generally considered unreliable. The EC proposal exempts those under six and over 79 years of age, from the requirement to provide fingerprints. Both age limits were considered unsatisfactory and not in line with international practice. The EU’s Eurodac system for asylum seekers, as well as the US Visit programme, use a minimum age-limit of 14 years, while the US Visit programme sets 79 as a maximum age limit.

Hustinx recommended that the age limit set in the EU plans should be considered as a provisional one. After three years, the age limit should be reviewed.

The EC has argued for lower age limits and a “one person, one passport” principle as biometric data of only the parent would be included on family passports, not that of the children.

Hustinx slammed the idea of member states setting up centralised databases, saying that “although it is possible for member states to implement only a verification procedure of biometric data using a centralised database (...) this option presents additional risks regarding the protection of personal data, such as the development of further purposes not foreseen in the regulation, or even fishing expeditions into the database which will be difficult to mitigate”.

Bulgaria’s Interior Ministry has yet to announce who would have control over and who would have access to the centralised database, if one were to be set up as part of the purpose-built passport issuing facility.

Hustinx recommended “to implement only the use of decentralised storage (in the wireless chip of the passport) regarding biometric data collected for EU member states’ passports”.

Privacy activists, IT and security specialists, have voiced concerns over privacy protection and unauthorised access to the data contained in biometric passports. Students from the Vrije Universiteit in the Netherlands have shown already, in 2006, that the chips used in biometric passports can be relatively easily read and copied, even when a protective cover that intends to interfere in reading the chip without physical contact is used. Lukas Grunwald made headlines in 2006 when he showed that it was trivial to copy the data on the chip in biometric passports creating, as he said, “a “false passport” using equipment costing around $200.”