< PreviousIf, as the well-known saying goes, “a picture is worth a thousand words”, a symbol can be worth considerably more. This is certainly the case for the chip-inside symbol that is part of every epassport in the world. Over 600 million ePassports have been issued since the chip-inside symbol was introduced in 2004. All of them are recognized because of the chip-inside symbol printed on the cover. The symbol dates back to the Fifteenth Meeting of the Technical Advisory Group on Machine Readable Travel Documents (TAG-MRTD) that was held in Montreal in May 2004.At that meeting, TAG-MRTD decided that a means to identify MRTDs containing a contactless chip inside should be created so that inspectors would recognize this increased capability and be encouraged to electronically read the chip’s contents when equipped with a suitable reader. As a follow-up to this decision, a task force of the two existing TAG Working Groups, the Document Content and Formatting Working Group (DCFWG) and the New Technologies Working Group (NTWG), launched a contest where passport manufacturers and members of the security printing industry were invited to design a symbol for this purpose.Five designs by five designers were presented to the task force and printed versions of them were anonymously placed on the wall of the TAG meeting room during the meeting. Members of TAG had a chance to study the proposals for two days before voting for their favourite. AND THe WINNeR IS…At the end of the meeting, the votes were counted, and by a substantial majority, the proposal of the Dutch security designer Joost van Roon (Sdu-Identification BV) was chosen.The symbol (Figure 1) depicts a contactless chip (the dot in the centre) securely packed between two layers of material. The image is a positive (i.e. the black part of the image) to be printed or otherwise imaged and the symbol must be included in the foil blocking or other image on the front cover. Aside from the appearance of the symbol, guidance for the use of it was also provided. The recommended dimensions of the symbol (Figure 2) as it is to appear on an ePassport book cover or data page are (in mm and in inches): 9.0 mm (0.35 in), 5.25 mm (0.21 in), 3.75 mm (0.15 in), 2.25 mm (0.09 in), 0.75 mm (0.03 in).lOCATION OF THe SYMbOlThe symbol is meant to appear on the front cover of the ePassport, either near the top or the bottom of the cover. It is recommended that the symbol also be printed on the data page in a suitable colour and in a location which does not interfere with the reading of other data. THe HIsTORy OF THe CHIp-InsIDe syMBOLepAsspORTs18 ICAO MRTD RepORT – Issue 2 2015Figure 1: The chip-inside symbolThe issuing State may print the symbol on the inside page or cover of the ePassport that contains the contactless chip-inside and, at the State’s discretion, elsewhere in the ePassport.A smaller size of 4.2 × 7.2 mm (0.17 × 0.28 in), scaled in proportion, is recommended for use on eMRTDs in the form of an ID1 size card.The symbol may be scaled proportionately for use in, as an example, background designs of ePassport pages or directional signs.eMRTD CRITeRIA ICAO Doc 9303 further stipulates that the symbol may only appear on an MRTD that contains a contactless microchip with a data storage capacity of at least 32kB that is encoded in accordance with the Logical Data Structure. As a minimum, it should also incorporate the MRZ data in Data Group 1 and a facial image in Data Group 2, with all entered data secured with a digital signature as specified in Doc 9303. Unless a passport conforms to these minimum requirements, it shall not be deemed an ePassport and must not display the chip-inside symbol. It was agreed that the chosen symbol should be copyrighted by ICAO.OTHeR SIgNAgeTen years have passed since the successful chip-inside symbol was introduced and, not only has it been used on more than 600 million ePassports, it is today a tool that is used by border control, inspection systems, airports and in various other capacities where ePassports play a role.Various other symbols such as (Figure 3) have originated from the chip-inside symbol and are used for ePassport related guidance at airports. TRIbuTe TO THe DeSIgNeRJoost van Roon’s experience in security design exceeds 30 years. While he never designed a banknote, this is just about the only field epAsspORTs ICAO MRTD RepORT – Issue 2 2015 19Figure 2: Dimensions of the symbolFigure 3: Derived from the chip-inside symbolin security design he did not enter. Cheques, certificates, diplomas, ID cards, passports, driver’s licenses have been his domain throughout the main part of his professional career. To mention only a few of his many accomplishments: the passport for Finland (version 2007), the passport, the eVRC and other sensitive documents for Slovakia, the passport and ID card for Albania, the passport and several ID cards for Mauritania, the ID card for Mali, the passport for Chile, the driver’s license for North Carolina, the passport and ID card for Interpol, the eVRC for the Netherlands and the complete range of traffic-related documents for Finland. In addition to these projects, he participated in the development of many other documents at Morpho Haarlem. He published in the Keesing Journal of Documents and Identity and made presentations at ICAO, Intergraf and other meetings and conferences.As Mr. Van Roon’s design has proven, the chip-inside symbol really is worth much more than a thousand words. 20 ICAO MRTD RepORT – Issue 2 2015xxxMRTD AND BORDER CONTROL NEWSSpainSpain has introduced a new identity card that can also be used as a travel document within the EU. The card contains a Radio Frequency ID chip and communicates with smartphones and other mobile devices by using Near Field Communication technology. Officials also announced the launch of a new ePassport that will include a more powerful chip.GermanyGermany and the USA announced a cooperation agreement on the reciprocal use of their automated border check systems: US Global Entry and Germany’s EasyPASS which both allow expedited clearance for pre-approved, low-risk travellers. A similar reciprocal agreement has already been initiated between Germany and Hong Kong in November 2014.JamaicaJamaica’s Passport, Immigration and Citizenship Agency (PICA) has installed Automated Border Control (ABC) kiosks to process passengers arriving at Manley and Kingston International Airports. The ABC kiosks will allow passengers to be processed in approximately 60 seconds. Jamaica offers this self-service to passengers of all nationalities, not just those who enroll in a trusted traveller programme. TunisiaTunisia has initiated a new project to introduce an electronic ID card and a new biometric passport. According to officials, the issuance of the new passports and ID cards will begin by the end of 2016. ICAO MRTD RepORT – Issue 2 2015 21xxx xxxEast African CommunityThe East African Community is planning to issue a new electronic passport to its Member States’ citizens beginning November 2015. New EAC passports will be fully compliant with ICAO standards. They will provide holders with an automatic six-month visa across the five EAC Member States: Tanzania, Kenya, Uganda, Rwanda and Burundi, and will also allow holders to travel around the world.CyprusCyprus began to issue new biometric ID cards to its citizens in February 2015. The Civil Registry and Migration Department announced that Cypriots are not required to replace their current ID cards, but new applicants will receive the new biometric versions.UkraineUkraine began issuing biometric passports in January 2015. Officials said that this move was one of the main elements of Ukrainian preparations for the introduction of a visa-free regime with the EU.United Arab EmiratesThe US Pre-Clearance Facility was introduced at Abu Dhabi International Airport in December 2014. The new automated passport control (APC) kiosks allow passengers travelling to the US to undergo all immigration and customs inspections in Abu Dhabi prior to departure. Using the new kiosks, passengers have their travel documents, biometric data and customs declarations processed. The biometric data is cross-referenced to verify the traveller. On arriving in the US, passengers are treated as domestic arrivals.The UAE is working on a new pilot project to adopt the latest technology to transform systems at all entry points. Officials announced that activation of different readers in the UAE airports will be part of the integrated biometric system to identify passengers and detect forged travel documents. A series of biometric e-Gates will also be deployed. The system will utilize eye scans, facial recognition and fingerprinting.22 ICAO MRTD RepORT – Issue 2 2015xxxTITRERoberto Kobeh González, President of the Council of ICAOxxx22 ICAO MRTD RepORT – Issue 2 2015MRTD AND BORDER CONTROL NEWSGhanaGhana has announced plans to upgrade current Ghanaian biometric passports with an embedded chip. The new biometric passports will facilitate transmission of data to computer.OmanThe Royal Omani Police introduced the new Omani ePassport in the beginning of 2015. The new ePassport contains an embedded electronic chip which stores the passport holder’s biometric data. Officials also announced that all Omani machine readable passports will be replaced by new ePassports.United States of AmericaHomeland Security announced that it will install 340 more Automated Passport Control (APC) kiosks that will reduce wait times for international arrivals by as much as 30%. The administration is also planning to expand the Mobile Passport App (MPA) programme first used at the Atlanta International Airport to speed up the process of customs inspection. The plan is focusing on the 17 major international airports which receive three quarters of all passengers. Miami International Airport has already announced that qualifying passengers can now use the MPA to submit their passport information and customs declaration form through their smartphones.IrelandIreland is planning to launch a smartcard which will be accepted as a travel document within the EU. The smartcard incorporates biometric security features including an embedded hologram photo on a strip on the reverse of the card. Irish citizens will be able to apply for the card through a smartphone application that can take photos that comply with international standards for passports. ICAO MRTD RepORT – Issue 2 2015 23xxx xxxxxxIndiaIn 2009, India launched a Unique Identification Number Project, named Aadhaar, to provide all residents in the country with a unique identification number through biometrics. As part of the pilot project, Indian authorities installed self-service biometric kiosks at airport entry gates in Bengaluru. Beginning in 2015, passengers holding an Aadhaar identification number are permitted to enter the International Airport in Bangalore using their fingerprints to gain access.European UnionThe European Commission has adopted a new Smart Borders initiative to facilitate travel for foreigners who frequently enter the European Union (EU) and to effectively monitor third-country nationals crossing the borders. The Smart Borders initiative will consist of an Entry/Exit System which will record the entry/exit information in an electronic database; and a Registered Travellers Programme which will allow frequent travellers to enter the EU using simplified border checks at automated gates. The pilot project will be in place in six countries: France, Germany, Netherlands, Portugal, Spain and Sweden, for six months during 2015.BangladeshBangladeshi officials have announced that they began to distribute smart National Identity (NID) cards on the Independence Day, 26 March 2015. Some 90 million smart cards will be issued under the Identification System for Enhancing Access to Services (IDEA) project. Smart NIDs will encompass some 25 services, including passports, driver’s licenses, banking, immigration, voting, marriage registration and health cards.24 ICAO MRTD RepORT – Issue 2 2015Acquiring a new MRTD solution is a challenge that calls for expertise beyond the technical requirements covered in Doc 9303. The new guidance material explores key points to consider when determining whether a solution will meet the needs of the tendering authority. Markus Hartmann, Chairman of the procurement Sub-group within the ICAO Implementation and Capacity building Working group (ICbWg), explains the purpose of the new guide. Procurement projects are often large and complex and consist of a multitude of discrete tasks that have to be completed within fixed time frames. These projects are extensive and intricate and require preparation and coordination to draw strategic connections between planning and implementation, and to establish a framework for cost minimization and certainty of delivery. Those seeking to embark on a procurement process for MRTD systems should be aware of the pitfalls and obstacles involved in such ventures so they can map out the procurement process to mitigate and prevent problems before they occur. The new Procurement Guide was developed by the ICAO ICBWG Procurement Sub-Group. Seven experts from various parts of the world shared their hands-on experience with major MRTD procurement projects. The goal was to develop a guide that could be used either as a self-assessment tool for States planning procurement, or as a reference paper for donors and supporting States in need. The Group did not want to reinvent the wheel. Existing procurement guidelines from other institutions were referenced and the focus was directed towards MRTD-related aspects. The guide was structured in three parts: 1. principles of getting procurement right2. Five steps in procurement3. Tip sheet covering questions and answerspROCuRIng MRTD-ReLATeD sysTeMs: THe neW ICAO guIDeMRTD sysTeMsAbOuT MARKuS HARTMANN He is an active member of the ICAO ICBWG since 2008. Markus is the founder and CEO of HJP Consulting, a Germany-based consultancy company with expertise in procurement planning and testing of electronic identity systems. For nearly 20 years, he has worked in the eID sector for a significant number of government and industry clients. pRInCIpLes OF geTTIng pROCuReMenT RIgHT▪ Is there a vision for the future use of MRTD technologies?▪ Has an assessment been carried out?▪ Has the impact on border control been considered?▪ Do we know who the stakeholders are?▪ Does there have to be a call for tenders?▪ Is the legislation sufficient?▪ Are budgets available?▪ Is there a development and implementation strategy?▪ Is there a Change Management Plan?▪ Has the procuring entity conducted a risk analysis?▪ Is there sufficient expertise available?▪ Is the public informed about the plans?Figure 1: Principles of getting procurement right ICAO MRTD RepORT – Issue 2 2015 25pART 1 - pRINCIpleS OF geTTINg pROCuReMeNT RIgHT The first part of the guide outlines the principles of procurement that should be considered before a project begins, and then revisited throughout the process. The principles include the future vision for the use of the MRTD technology; a comprehensive assessment of external markets; local legislation and internal stakeholders; as well as a thorough risk analysis and Risk Management Plan (see Figure 1). pART 2 - FIVe STepS IN pROCuReMeNTA good procurement project follows a five-step procurement process from: 1) defining needs; 2) preparing the tender process; 3) evaluating bids; 4) awarding contracts; 5) managing change. While these steps are reasonably generic, this guide focusses on specific points of relevance for MRTD issuing authorities and border control agencies. Defining NeedsThe guide recommends that States clearly identify the root cause of the problem they wish to solve and the outcome they expect from procuring a new MRTD-related system. It is paramount that any MRTD-related procurement process begins with a thorough assessment of the current situation. The solution to the problem is not technology-related at the outset. Authorities should begin by looking at their internal processes in the areas of:■■generating and managing the civil status of citizens;■■document-based identity verification at borders and other public or private use cases;■■(internal) fraud in the issuance and/or verification processes of MRTDs;■■lack of trust from Visa issuing States in the issuance process;■■the non-compliance of the MRTD with the latest (ICAO) international standards; and■■the cost-effectiveness of legacy processes and systems.All investments in MRTD systems must serve the purpose defined by the procuring authority. At the same time, authorities are obliged to use the taxpayers’ money with great care. An 80kb chip for a passport or a biometric e-Gate must be considered a tool, given that it has no purpose of its own. Vendors are selling products from their portfolio or solutions that suit their products. It is the authority’s responsibility to make sure that these products and solutions will serve its specific needs. The “Investment Logic” tool can help authorities find the root cause of their particular problem (see Figure 2). preparing the Tender processWhile for the most part, public authorities know how to follow procurement processes, the guide encourages the use of two types of tender documents: 1) a Procurement Plan, and 2) a Tender Document. While the tender document itself is being issued to the market for vendors to respond to, the procurement plan is for internal use only and details how the procurement process is to be undertaken. Moreover, the guide draws special attention to aspects that are paramount to the success of the MRTD project. Shortfalls in fulfilling internal work packages often cause problems during the implementation phase of the project: vendors need to work with officers who are experienced with the legacy system; office space may need to be adjusted to accommodate the technical requirements of the new machines; and IT systems and the logistics of security sensitive materials (such as passport blanks) may require improvement.Contracts should always be carefully written and must contain the fundamental legal obligations of each party, along with project-related procedures. Notably, the contract assumes great importance in the event of a dispute and must be written to clearly identify the roles and responsibilities of each party. evaluating bidsMost solutions submitted by vendors will look good on paper. It is the authority’s responsibility to find the best bidder and most suitable solution, and since a solution will be used for a five-to ten-year period, the solution must be trustworthy. Bids should be evaluated by a multidisciplinary team with a variety of subject matter expertise (such as technical, business processes, operational, security, commercial, legal, project management). The team should represent all stakeholders MRTD sysTeMsInVesTMenT LOgICpRObleMbeNeFITS OF SOlVINgTrustSOluTIONSWould you invest in an eMRP?Data sharing and improved civil registrationNew Issuance SystemPassport not trusted by other StatesComplianceNo Evidence of Identity CapabilityRobust processNon-compliant PassportInternal FraudFigure 2: Points to consider when defining the needs for an MRTD-related systeminvolved in the decision-making process. It should also be balanced in terms of hierarchy and ranking (within the team) so that the evaluation process cannot be overly influenced by one individual. The evaluation should follow a phased approach. One example is illustrated in Figure 3. Awarding ContractsWhen the bidder has been selected, it is up to the authority to turn the vendor’s promises and commitments into legal obligations. The contract should set out, in clear, unambiguous detail, the entire commercial understanding between the tendering authority and the vendor. The technical and operational specifications that underpin MRTD delivery, including the rules relating to relationship governance and logistics, must be identified in the contract. The MRTD project contract is an essential tool for transferring ownership of key assets and for establishing the scope of licences and rights that cover core technologies which may be embedded within the MRTD. The contract provides the structure for project delivery and addresses future risk mitigation and liability issues so both parties can achieve their commercial objectives. Finally, the contract contains penalties in the event the vendor does not meet any obligations over the course of the project.MRTD sysTeMs26 ICAO MRTD RepORT – Issue 2 2015 eVALuATIOn pROCessFORMAl RepORTTeCHNICAl RepORTeVAluATION RepORTBest solution rankingBest offer short listBest bidder decisionEvaluation of formal requirementsEvaluation of technical offer (system architecture and e-passport)Evaluation of financial proposalPresentation by final 3 biddersEvaluation of project handbook (project management and delivery time)Value-for-Money indicatorEvaluation of optional requirementsOverall impressionExclude from Evaluation processFigure 3: Sample of an evaluation processThe goal was to develop a guide that could be used either as a self-assessment tool for states planning procurement, or as a reference paper for donors and supporting states in need.Managing ChangeThough MRTD solutions are often planned for a 10-year period, it is likely that either party may request a change to the agreed terms and conditions. For MRTD-related projects, changes might be required when new security risks arise or to accommodate new technology. It is of paramount importance that any change is managed within a well-defined change management process. MRTD documents, once issued, remain valid until their expiry date. Changes in the documents themselves are best avoided, but when necessary, must be clearly specified and communicated to all ICAO Member States.pART 3 - TIp SHeeT COVeRINg QueSTIONS AND ANSWeRSWhile the main body of the guide provides sound advice on how to organize the procurement process for MRTD-related systems in general, the attached tip sheet should provide pragmatic ideas for more specific points to watch. See an example of the tip sheet in Figure 4.The table shall become a living document, where members of the ICBWG Procurement Sub-Group will continuously add tips and practical suggestions to procure MRTD systems. Government authorities are welcome to share their own experience within their MRTD-related procurement processes with the ICBWG, proposing new entries to the Tip Sheet. Please email the ICAO MRTD Secretariat at: fal@icao.int. XXXXX ICAO MRTD RepORT – Issue 2 2015 27pOSSIble ISSueSuggeSTeD TReATMeNTDefining Needs: ICAO deadlines 2015▪ Vendors may misuse deadlines published by ICAOStudy ICAO time schedules in detailICAO deadlines need to be read carefully▪ 24 November 2015 deadline is not saying that states have to issue e-passports, but that states should not have non-MRPs in circulation any moreFigure 4: Sample of one entry of the Tip SheetAll investments in MRTD systems must serve the purpose defined by the procuring authority.Next >