The US allows government Passport electronic chip assembly to occur in the same Bangkok suburb where a notorious Terrorist extremist was captured in 2003--posing a major homeland security threat if Terrorists obtain blank chips to forge fake American E-Passports.
While the U.S. Government Printing Office (GPO) claims that there has been no security breach, a Wired Magazine feature stated (three full years ago) exactly the opposite: "a German computer security consultant has shown that he can clone the electronic passports that the United States and other countries are beginning to distribute this year." That computer consultant/hacker, Grunwald, demonstrated the United States Passport cloning technique that he'd found at the Black Hat security conference in Las Vegas, Nevada, 2006.
The kicker: United States Passport chips are sent to Germany after manufacture or assembly in a Thai facility. The hacker who exposed the security issue: German. The common German theme is simply a bad twist in the real security issue gaining controversy--that the electronic chip creation or assemblly is in Thailand, when those Passport chips could and should--i ensuring maximum security to the country--be manufactured and/or assembled within the United States.
Currently, the potential Passport cloning security issue is at the forefront again: Democratic Senator Charles Schumer (NY) is demanding the U.S. Government Printing Office (GPO) halt overseas production of the overseas and outsourced electronic chips that are currently being used in making American Passports, also known as E-Passports.
Joint investigation by ABC News and the Center for Public Integrity reveal a years-long failure by the GPO agency to resolve persistent questions and concerns about security risks involved in the outsourcing of components in U.S. Passport creation--one of the most crucial security features on U.S. passports is still being outsourced abroad, despite the fact that officials say at least 25 United States companies have the ability to create those same chips.
Senator Schumer demanded Tapella and the GPO "take immediate action" to stop production of the U.S. Passport electronic component that is being assembled at a factory in Thailand; the American Passport's electronic component is considered the key piece of the United States' newer (and supposedly more technologically sophisticated) E-Passport.
Since production of the new United States Passports first began in 2006, four years ago now, investigators and members of United States Congress have complained that the E-Passport's electronic component, a chip and antenna that stores information about the Passport's owner, have been manufactured overseas versus within the country.
The GPO agency has previously stated that supposed reason for the component being outsourced is because no United States company could make the electronic chip.
Senator Schumer says that's not true, that there were "more than 25 companies in the United States—and at least five companies in New York [state alone]—who possess the capability and knowledge to manufacture the [Passport's electronic] chips that are currently being manufactured elsewhere and assembled in Thailand."
On a number of levels this is extremely troubling," said Clark Kent Ervin, former inspector general at the Department of Homeland Security. "Something like that [the electronic component of Passports that is the key piece of the more advanced E Passport] ought to be produced only in the United States, under only the most rigorous security standards."
Despite repeated assurances by GPO that the electronic chip production for Passports would be moved to the U.S., it hasn't happened yet--and the U.S. government has continued to allow a key government contractor to assemble an electronic component of the American nation's new, more sophisticated passport in Thailand. Frighteningly, the factory where the American Passport chips are being assembled is near the same Bangkok suburb where a notorious Terrorist extremist was captured in 2003. There have been bursts of violence in the industrial city where the chips are made, Ayutthaya, as recently as last month.
Both the U.S. inspector general at the Government Printing Office and the agency's own security chief have both warned specifically against producing America's crucial computer chip assembly in a Thai facility. One internal report, says ABC and the Center for Public Integrity, warns of a "potential long term risk to the [United States government's security] interests."
Tapella declined ABC News requests for interview regarding the U.S. Passport chip manufacture. When ABC asked Tapella why repeated warnings about security of the Passport supply chain have not been resolved or moved to internally within the country, he replied that government contractors were in the process of moving work on the United States Passports out of Thailand and into a newer facility in Minnesota. But the government's not forcing the issue that has been going on for years: instead of pulling the contract for the Passport chip manufacture, the United States has allowed the contractor to continue the overseas manufacture in an area and facility that is physically within miles of known, previous Terrorist activity.
"I believe the [U.S] Government Printing Office along with the Department of State, are doing everything necessary to maintain and secure the passport supply chain," says Tapella. It's curious how that statement is made, when a contractor is overseeing manufacture.
The Thai factory used in U.S. Passport manufacture was one of several concerns contained in an inspector general's audit earlier this year that looked into the way the GPO is producing the new E-Passport--a United States Passport that is supposed to be impenetrable to counterfeiters, while storing Passport holder information on an embedded computer chip that is tucked into the Passport's cover.
Security experts say that Passport production being outsourced is a critical United States Homeland security concern, since simple possession of an American passport can help a traveler (or Terrorist) bypass some of the stringent reviews that would normally be conducted by Customs when entering the U.S. from abroad.
Ervin describes the U.S. E-Passport document, containing the chip, as an EZ-pass into the United States country-- something officials say that Terrorists know all too well. GPO's inspector general has warned that the agency lacks even the most basic security plan for ensuring that blank E-Passports and their highly-sought technologies aren't stolen by Terrorists, foreign spies, counterfeiters as they find their way through an unwieldy American Passport manufacturing process that includes 60 different suppliers across the world.
Democrat John D. Dingell, of Michigan, wrote letters to the agency two years ago in questioning the process of United States Passport production. "Regrettably, since then, our fears [about outsourced U.S. Passport production] have been realized because the inspector general and other people in charge of security at the government printing office have pointed out that the security is not there," he told ABC News.
"There is no real assurance that the E-Passports are safe or secure, or are not in danger of being counterfeited or corrupted or used for some nefarious purposes by Terrorists or others." Dingell said the GPO agency needs to make good on its years of promises--to actually move production of the United State Passport's electronic chip assembly into the U.S. physically. Gary Somerset, a spokesman for the agency, said the process of moving electronic chip Passport production into the United States is supposedly well underway:
Somerset gives an estimate that only one in five American Passport chip assemblies are still assembled or created in the Thai factory--but security experts believe that number should be zero. Somerset claims the GPO agency has pledged to move out of Thailand completely by the end of July.
At the Ayutthaya plant in Thailand, where the electronic chips for U.S. Passports are still currently manufactured, Thai workers assemble inlays that embed wireless transmitters and sophisticated computer chips that store personal information of the American Passports. That information is then used by United States Customs and border guards in order to verify the identities of travelers entering the United States country.
The inlays are then, staggeringly, shipped back to Germany so that they cross at least two countries before returning to the United States, where eventually the full E-Passport is assembled in the U.S. The battle rages over whether possible theft of blank computer chips assemblies could enable someone to clone a fake U.S. E-Passport to gain entry to America. Ari Juels, chief scientist at RSA Laboratories, a Cambridge-based security research group, says the risk is that someone--including a Terrorist--could take information from a stolen Passport and imprint it on a blank chip, which could then be embedded into a forgery of a Passport.
"Getting a hold of an inlay might help someone to create an authentic looking copy [of an American Passport to gain entry to the United States]," he said. Somerset said that has never happened [to date], to his knowledge. "There has been no [known] security breach in the United States' electronic Passport supply chain," he claims.
Officials at the Dutch electronics contractor that owns the Passport chip assembly plant in Thailand, named Smartrac, told ABC News that the company tightened security there since the first security concerns were raised inside GPO. Is that a bit frightening-if security needed to be "tightened", then it couldn't have been entirely secure during previous manufacturing time.
A Smartrac spokesperson also says that employees "undergo a background check to assure that highest security standards are not only met in terms of [chip] production environment but also in terms of personnel." None of those supposed facts comfort Robert Sheridan, a retired United States Customs agent and former GPO investigator--who has been following the American Passport security issue for years now. "A Passport is the keys to entry into the kingdom," Sheridan said. "Somebody better wake up."