Hacker News new | past | comments | ask | show | jobs | submit login
Germany bans digital doppelganger passport photos (reuters.com)
258 points by aloukissas on June 4, 2020 | hide | past | favorite | 223 comments



Surely manipulating the photo beyond tweaking exposure, white balance, etc. was already banned?

It sounds like they're just taking steps to make it harder to do the already-banned thing. Hell, you can't even fix red-eye in the US:

https://travel.state.gov/content/travel/en/passports/how-app...

> Can I remove red-eye from my photo? No, you can not digitally alter a photo to remove red eye. You will have to submit a new photo without red eye.


That's why they will now require you to have your photo taken either at a passport office or at a photographer's. Although the wording in the article is not quite precise on the latter part.


Originally the plan was to only allow taking of passport photos at local government citizen services offices (which is where passport applications occur). Photographers successfully made the case that this destroys their businesses (usually 30-40 percent of revenue). It appears that now photographers must digitally upload the photo to a government website. Details on that are still unknown.

This article (in German) is pretty good.

https://www.golem.de/news/foto-morphing-regierung-macht-digi...


The photographer business is 40% passport photos?

That seems unlikely, so I think I misunderstood,could you expand?


It‘s true - passports get invalid after 10 years here. I translated this source [1]:

„The photographers in Ingolstadt and the surrounding area also take a critical view of the idea of the Gerolfingen Minister of the Interior. Very critically. An adjective that keeps coming up: threatening his very existence. Theresia Häusler from Foto Porst Am Stein says: "We take 20 to 40 passport photos per day." At normal market prices of between 15 and 20 euros for the pictures, you can work out what the loss of revenue per day is. Up to 50 percent of the revenues could be lost in your branch, says Häusler“

I mean, you don't really need these businesses nowadays that much. Just take a picture with your phone, no need to develop it.

[1]: https://www.donaukurier.de/lokales/ingolstadt/Existenzbedroh... (German)


Almost every photographer that hasn't specialised into a certain area does passport photos. They usually have a always-ready booth setup in their shop to take those kinds of photos. ID cards/passports are required to have and are valid for 10 years, so even in a small 1000-people town it can easily amount to about 1-2 passports a week (which usually costs around 10€-20€). If you cover any type of larger area that can easily cover most of your photography business costs.


but couldn't you take passport photos from the small automatic photo boots that are available in shopping malls or train/bus stations and such?


There's a EU-wide standard for passport photos. Your head has to be properly aligned within a specific frame. You must not show any facial expression. The lighting must eliminate shadows and "shiny" spots.

Regular automatic booths do not check for all those issues. Sure, you can probably create a booth that handles them, but then you will probably also start charging as much as the photographer. And its a one in 5 years affair, so why bother going to a booth?


I did my Irish passport photo on my phone.


People still want to look good in their ID photos.


Passport pictures are unreasonably expensive here in Finland. Luckily you can register as a photographer for passport pics with the police, and do your own. I've been doing my own, and some for friends, for many years now. The last time I paid for one (probably 13 years ago or so), it was upwards of 20Eur


You can register, but you don't even need to. The submission page allows you to say that you are an individual.


But that's exactly what this new German law wants to prohibit, people being able to shoot their own passport photos.

Now, how difficult would it be for someone with enough criminal energy to forge passport photos to beomce a registered photographer who's allowed to "securely" upload passport pics?


The context is Finland in these comments.


I thought they always required a professionally taken photo? In Canada you need to go to a photographer (lots of malls and general stores have one) to take your photos and then stamp and sign them at the back making them eligible for passport submission.


How does this make any sense as a security measure? Real criminals will always find a photographer who would produce whatever a picture they want and stamp it.


Presumably there is some level of traceability to this. If a falsified photo is found on a document used to commit fraud or other crimes, the photographer who enabled it would be banned, blacklisted, and possibly held criminally liable.


What prevents me from stamping "Walmart at 123 Example Avenue" then scrawling an incomprehensible signature on any photo I want? The stamps the shops use don't have any security features to them.

Unlike the old "guarantor" system where a licensed professional or public official (judge, lawyer, doctor, etc.) had to sign your application - basically, people who the government could verify the existence of and hold accountable - there's not very much traceability to the photo system.


Canada's guarantor system is still in place, although the guarantor currently doesn't have to be a licensed professional.

As an American immigrant to Canada, I don't see the point - the US has never in my lifetime had either a professional photo requirement or a guarantor requirement for its passports, nor even a digital requirement.

Certainly, paying someone like a pharmacy for passport photos is not rare in the US to reduce the risk of out-of-spec photos leading to a rejection. But that's just a common personal choice and not obligatory.

I suspect Canada's guarantor system is inspired by the UK's, though I don't actually know.


You may have found an actual use for blockchain.


I doubt this is going to prevent even a single serious crime.


In New Zealand you can take them yourself and submit them digitally when you apply for renewal online. I did it with my DSLR on its timer, then cropped and converted to JPEG with Krita or Gimp. I believe the new photo is compared to the old one by a person. Maybe our passport office is being a bit naive? It used to require more hoop-jumping though.


I think it's less naive, I trust they're aware of the risks, and more that passport fraud of that sort just doesn't happen on a regular enough basis to require better security. Occasionally a Member of Parliament [0] or foreign intelligence agency [1] has a go, but passport fraud is overall low.

I'm sure they also have automated tools for detecting photo manipulation.

The whole process for getting an NZ passport is an order of magnitude easier than a European passport. Here in Australia I was able complete the entire process online, and they couriered my passport to me from the Sydney consulate. I also have a passport for a European country, and last time I renewed it, I had to make an overnight trip to the consulate and spend half a day getting my passport renewed. I needed to get my photo done by an approved photographer, and they also scanned my fingerprints to store in the passport's chip (they don't store fingerprints for NZ passports).

[0] https://en.wikipedia.org/wiki/David_Garrett_(politician)

[1] https://en.wikipedia.org/wiki/New_Zealand_passport#Use_by_Is...


Well it ain't for nothing that New Zealand is Mossad's favourite fake passport when assassinating Palestinians in foreign countries. Probably other factors as well tho.



link?



This is the only time they were caught:

https://en.wikipedia.org/wiki/2004_Israel%E2%80%93New_Zealan...

But it's safe to say that if they were caught once, they've probably done it numerous times.


You can take them yourself in the US and print them out, although I think most people don't. I saved about $14 by doing that.


Same. I had some taken at a local store, and thought they came out terribly. Not worth the money at all. Set up my DSLR in the kitchen on a tripod, digitally placed 2 right-sized copies on a 4x6, and printed them at the drugstore for less than a quarter. I used decent equipment, but a modern phone these days will take an acceptable photo. (In fact, I just searched the iOS App Store at there’s at least a few apps that claim to make acceptable photos.)


Plus, unlike at a photographer's, you can repeat this process in your kitchen 50 times if you want until you get a picture that you're happy with.


Same here, as long as you have white backdrop (large poster board from an old school project) and are able to crop/print it to the correct dimensions there is no need to get a professional picture. When planning the family vacation, were looking for any ways to cut costs a bit


German passport photos (until now) could be taken by those photo machines that are all over the place. Australia requires a printed photo that’s most easily taken at a shop but doesn’t have to be.

Disclaimers: it’s been 6 years and 2 years since I’ve had to do this.


Weird. In Sweden its required to have your picture taken by a machine at the police office where you apply for the passport.


Weird indeed. This is my second reminder today that technology does not spread equally around the globe. The other was hearing my wife ask the IT-guy in her company if they had a fax number for a form from the Italian government.

After having my photo taken at the police office for at least my two latest passports it's somewhat surprising to hear about so many countries still using "the old way". There are such obvious advantages both in security and convenience by having the passport issuer take the photo and the technology is obviously available.


Same in Switzerland, alas it's the designated passport office and not a police station.

They have a specially kited photo booth, where you also leave two fingerprints for additional biometric verification.

In order to renew your passport you need to schedule an appointment withyour local passport office.

Last time I renewed, 2013, it took 7 weeks until the earliest available appointment, which was a bit surprising. I'm sure, though, there's an emergency shortcut for a price.

The new passport arrives two days later by mail.


In Finland you can submit your own photo through the internet. All applications are verified by the police so I don't see the issue.


From the article:

> Such manipulation of photos is typically invisible to the human eye, the researchers found.


By the police I do mean the Police, ie not just an individual police person or civilian working for the police. I'm sure they have both automatic testing AND human control.


No you can't. Only a licensed photography studio can do it [1]. You can, however, submit a paper photograph taken by anyone.

[1] https://www.poliisi.fi/passport/passport_photo_instructions


I literally can. Please don't spread misinformation when I doubt you even are a Finn.

https://lupakuvienvastaanotto.fi/Default.aspx

E: not to mention that the page you linked doesn't even say anything about prohibiting self taken photos.


You can register as a photographer very easily. I've been doing my own pics for years now.


You don't even need to register as a photographer (to submit other people's photos). You can do it as an individual just fine, as the submission page directly mentions.


In Australia, the photo has to be signed by a guarantor [1] stating it's an accurate photo. However the guarantor can be any Australian passport holder who's known you for over a year and isn't an immediate relation/partner etc, so it's not particularly fraud proof.

1. https://usa.embassy.gov.au/guarantors


The other part of that is that the original article mentions that often the morphing is not visible to humans, so its possible you can get a morphed image guaranteed just like any other.


Every time I've done this my guarantor hasn't scrutinized the photo, just glanced at it. And ditto when I've been a guarantor: "Hey al you sure you don't want to get a haircut before getting your passport?"


I wondered about that. Hard to imagine any other useful (because lack of quality) use for these. Will they sue, or embed some new firmware with EURION and wireless whatever uplink?


Quite a few Korea & Chinatown will beautify your photos and submit them. The ones I been to will do so without even asking. They've been around for a while.


This seems reasonable, as the entity taking the photo is essentially attesting the photo is of you.


Currently you can bring your own picture which makes it possible to do certain modifications beforehand.


Possible, yes. Permitted, no.

The "photographer submits via a secure form" approach detailed in the article leaves this loophole pretty open, too, unless the photographers have to go through some kinds of security clearance vetting to get access.


Not really: a paper trail and a process that requires the photographer to be knowingly and provably complicit would already create a pretty high barrier. Not an insurmountably high barrier, but no amount of vetting could.


When I got my first drivers license (Germany) the photographer actually digitally removed some moles from my face and did other editing to make the picture appear more good looking. I was a bit baffled as the picture is supposed to identify me but didn't say anything. Since then I always take ID-pictures in a photo booth. It really doesn't need a professional to take an acceptable picture.

I could imagine a photo booth outputting a digital copy of the picture with signature so it is clear to the registration office that the picture has not been meddled with.


Or that the photograph of the large photograph the booth took a picture of has not been meddled with.


> unless the photographers have to go through some kinds of security clearance vetting to get access.

Passport picture photographers will need a license in Germany.


The blackmarket is very much alive and well in Germany, allowing photographers to verify anything is silly, they can be bribed. :x

In fact when I lived in Austria, within a couple months I had access to more black market goods/services then I did after growing up in the US for 25 years. I would imagine Germany is the same.


The point isn't that they can be bribed, it's that the photographer has to attach their name to the photo and certify that it hasn't been altered or tampered with. It adds the ability to go after the photographer if they gov't ever discovers tampering has been done.


This is also where it is important to point out German culture.

Germans are extremely law abiding and rule following. People are also generally worried breaking social norms.

So while it is technically possible for photographers to digitally alter photos before upload, there will be very few who would dare to do that.

Photographers rely on the revenue from passport photos for their businesses to survive. Initially the plan was to exclude professional photographers too but the government backtracked on that after outcry.


New business model. Pop-up photoshop. Like the countless other businesses popping up, operating for a few months, washing money, closing down, owners gone, employees unknown, and so on.


Except it takes a while to start a business in Germany and there is lots of paperwork involved. Also it sounds like licensing is required to be able to take passport photos. Chances are that licensing might apply to both the business and the individual photographer.


What do you mean by this? What kind of black market goods did you have access to?


Given location and user name, probably milk.


Seem sketchy, given

> after growing up in the US for 25 years

and the average lifespan of the species being 12-15 years.


I don't know about Austria bit there is a healthy market in Sweden for anything which is heavily taxed - mainly alcohol, cigarettes.


Alcohol and cigarettes are always on the black market close to US military bases. Prices are always cheaper for service members and their family on base.


Databases of credit card numbers on USB sticks, etc


The blackmarket is obviously bigger outside of the US where US law and enforcement will be encouraged to go after blackmarkets more strongly than another company.


Is there some sort of camera fingerprinting technology out there, then, that distinguishes between processing done on the camera vs. post-processing in software? If not, how are we even going to tell, short of having signed files coming off the chip?


I could use some CGAN scripts to make a picture of me, which - to your eyes and mine, looks like me - but nevertheless does not have my official physical metrics, and thus I could pre-dispose future AI against recognizing me.

I could. But, I won't any more, because Germany will make life a hassle for me.


We already have face recognition AI using passport photos by the UK border control. https://en.m.wikipedia.org/wiki/EPassport_gates


I've tried one of these scripts. They were pretty poor. The best one was Zuck's profile pic which already looks like deep fake...


Makes it possible or makes it legal?


We developers sometimes struggle with the distinction. The point of laws and regulations is usually not to make fraud technically impossible, but increase the cost and/or risk of getting caught. People still use locks on doors even though they are easy to pick.


> No, you can not digitally alter a photo to remove red eye. You will have to submit a new photo without red eye.

What if the camera does that automatically without you knowing? Technically that still is "digitally alter a photo to remove red eye" (by the way there is no such thing as an unaltered digital photo). What if the camera lets you know it does and offers to turn that off - should you? What if an import script (which fires as you plug your camera/card) on your PC does that without you knowing? What if you know it's there? How does the result of any of these scenarios considered different from just doing that in Photoshop?


When I last got my Australian passport renewed, the guy in front of me had his photo rejected because it had been edited. They had some sort of automated analysis that I presume worked off spotting weird JPEG aliasing.

If there are signs it's edited, they'll tell you to come back with a different photo. (In this case, there was a photo shop a block away they had an arrangement with.)


Presumably that would only work if you hand over the digital photo. Converting it to analog (printing it) would lose all this data. You could then also rescan from the analog and receive a clear jpeg that should pass most tests depending on how good your scan was.


You submit physical photos, which Australia is insanely picky over. My most recent renewal took me three tries across three separate camera stores before I found pictures they were happy with.

The review process seems to be manual as far as I could tell, or at least it took O(days) each time for the results to come back.


These were analog photos. The scan came up on the screen and highlighted edges where the photo had been tweaked.


The camera would rather preflash a little bit to narrow your pupils, and then take the picture an instant after that preflash.


Huh, I took my own passport photo, adjusted the colors, fixed some red eye and even touched up some blemishes and dark circles under my eyes. Why make a rule if you have absolutely zero intent or ability to enforce it?


Selective enforcement. If everything is illegal then you can enforce the laws however you like.


I did the same thing, and it's obvious they know people are going to do it. So why make the rule? I suspect it is so that you can't argue about whether it is or isn't touched up too much if they don't happen to like it. If they can show any touching up at all, they can drop the hammer on you.


Yeah they were always quite intense w/ German passports anyway. And the tech seems quite sensitive.

e.g. Movember caused the airport gates to flunk me


> No, you can not digitally alter a photo to remove red eye.

How about analogically alter the photo?


Print it, use a colored pencil to edit it, scan it.


The funny thing is, as I recently had to renew my ID card, I would have been happy, if the local authorities had offered to take my picture. They rejected the picture I brought, because they claimed my head was angled not straight ahead enough and I had to run out to find someone to take a picture of me. Luckily they could refer me to a local shop nearby which was open at that time, but considering the low quality of those ID photos, having a web cam in the office would be an obvious and easy improvement both to the security and the convenience of the process. They already had a fancy tablet, where I had to provide my signature digitally.


Yes, here in Switzerland all identity photos are taken in booths at the passport office, which has the advantage that any photo they take is, by definition, compliant with their requirements regarding angle, facial expression, etc.


Same in Norway. It has been like this for a number of years already.

Somewhat funny story: I and my wife renewed our passports this year and we both look a lot nicer:

10 years ago the requirement that we should not smile was enforced so strict and hamfistedly that I looked like a mugshot somewhat like the doom guy and my beautiful wife looked old and sad. I remember it taking a while before they thought I looked angry enough 10 years ago.

This year they only required that we didn't actually smile so the process was a lot quicker, police will probably not harass me on border crossings and my wife doesn't look like she is 20 years older ;-)


I wonder... could you use a mugshot?


I think you could except they are often not on a white or almost white background (a US requirement.)


In the US I had this done in the post office by an on-premise photographer. It's also where I picked up the form to fill out to get a passport in the first place, and where I was going to mail it from anyways, so it's not like the US doesn't have one-stop-shops for this.


Same in Sweden, the passport/ID applications are done in an all-in-one booth that takes your photo, reads your fingerprint, and digitizes your signature.

The downside to this is that as an expat, the only way to renew a passport is to fly across the country to visit the embassy in person. And Swedish passports only last 5 years.


It's the same in Romania.


> Luckily they could refer me to a local shop nearby which was open at that time

Not telling that is the case but happens all the time in India. The local shop and this guy have a profit sharing deal :-)


I suspect the fact that we do it this way in the US may be a small part of why DMV lines are legendary - that being said, Germany may be able to implement it better.


DMV lines were at least as bad, probably worse before the days of digital photography....


Mixed feelings on this. On the one hand, I prefer not having to spend an extra hour to find a photo place each time I need new documents. On the other hand, I have a good photo on my documents :)


This ban probably comes as a response to this activist project by the Peng! collective: https://pen.gg/campaign/mask-id-2/ where they used morphed portraits for passports.


So if I understand correctly, the kind of attack enabled by this manipulation is to provide a way for non-passport holders to pass custom controls by using the legitimate passport of the person they morphed their picture with. Is there any other useful kind of attack possible with this scheme?


Sure, you go through one of the automated gates, pretty common in most European airports now.

Face recognition gives the green light, since (part of) the picture is a perfect match.

A human may not be fooled, automated face recognition may.


from the article:

>Such manipulation of photos is typically invisible to the human eye, the researchers found.

I think its more like attacking a machine learning model - the difference in the photos may not be apparent at all, so a human reviewer might not catch something.


That is unlikely. Germany can't get enough from "non-integrating gap countries"-immigrants. They have the reputation of integrating really well into western society.


Nice hack, now wondering if you can wear the 'Angelina Jolie' glasses frame[1] for your picture.

Funny story, when my passport was stolen in London I had to go to the US Embassy there to get a replacement, I brought a picture that I got in the tube station from a "passport photo machine". The embassy rejected it, requiring instead that I go to a specific photographer who was located about 2 blocks away. That guy charged me 20 pounds sterling for two black and white photos.

My wife kept that one after it had expired because in the photo I have a smoldering look of disgust :-)

[1] https://www.theverge.com/2016/11/3/13507542/facial-recogniti...


I don't know if it's the same for US passport photos, but US visa photos need to be a larger square whereas most European photo requirements have a smaller portrait aspect ratio.

The photo is no different, it's just that there's prescribed size in imperial units for US visa photos. At one point I went to a photo shop to get US visa photos since I knew a photo booth wouldn't do the right thing, but they printed out Euro style photos by mistake, and I had to ask them to do US ones instead, so I got both sets of photos. Exactly the same zoom, exactly the same photo, just the Euro style was cropped more.

Edit: I looked them up:

https://www.gov.uk/photos-for-passports/photo-requirements - 35mm wide by 45mm tall.

https://travel.state.gov/content/travel/en/passports/how-app... - 2 inches square.


In the US you can’t wear glasses at all for your passport photo, even if you always wear glasses.


This is really really new, I've owned three passports (including my current one) where I'm wearing glasses.

Apparently it's cause people can't figure out how to take a photo with glasses properly.

https://travel.state.gov/content/travel_old/en/news/no-glass...


I wouldn't say it's really that new, assuming an even distribution of passports over time, close to 40% of active US passports probably fall under those rules.


That would still mean 60% of passport holders will be surprised by this change. I hadn't heard of it, and I'll need to renew my passport in a little over a year.


Is this AI generated text? It doesn't provide any context a normal human would want. The attempt at providing context feels exactly like an AI searched a database of summaries of research for something related.


Reuters and Axios tend to have very... terse articles. Some being no more than a sentence or two.


This is kind of weird. I had my German ID (not passport photo, but visa ID & student ID) photo taken at an official photographer's, and he spent a good deal of time photoshopping my face to make me look more attractive. This is the only country I've ever seen this done. They certainly don't do this in the US...


Is there any reason in a digital camera age to not have the passport office agent take the photo?


The current answers are simply wrong.

I describe German bureaucracy for a living. Here's a free sample: it's slow and inconvenient.

Distributing part of the process to photo booths means you can show up, hand your documents and leave. This is already more than most locations can handle. Adding to their burden won't help.

As someone else pointed out, some processes can be done by mail. Driving all the way to Berlin to sort out paperwork would put rural communities at a disadvantage.


> I describe German bureaucracy for a living.

Is this for a documentary series? I can imagine a David Attenborough series on bureaucracies of the world. Sounds both fascinating and scary.


Unfortunately not. "The Amt Before Time" never got picked up by the BBC, and without Attenborough, it just wasn't worth it.

I maintain All About Berlin. It's a collection of guides for settling in Berlin/Germany. It's basically a list of things I wish people explained to me.


At least they adhere to the rules, the process is slow and inconvenient for every resident, unlike my home country where process difficulty ranges from extremely easy to impossible based on who you know and your political status.


They try to adhere to the rules. In practice, there is a lot of variance within a single building.

For instance, my friend managed to do something by email. The same day, I got an answer from the same office confirming that it was impossible.

I spent months documenting the freelance visa application process, and worked with several relocation consultants to document it. A person I helped got a 3 year visa on the same day. It took me 2 months to get a 2 year visa, even though I coached him and had a far simpler case.

I have a copy of their process bible, a 1000 page PDF in thick German. I can assure you that they don't follow what's in it.


Visa process is some of the worst beurocracy in any country, since people using jt are by definition non-citizen, dont vote, and have less recourse. Often a new policitican comes in and gives new direction for very liberal interpretation of current rules. I have many years of experience with Czech and Uk immigration systems, and both are a mess, and dont really comply with the law.


The process for transferring a vehicle or registering your address is hardly more satisfying. They're all equally unreliable and complicated.


What about the address registration is unreliable? Yes, you have to go in person but apart from that it's a pretty quick and standardized trip. (The appointment problem is a pretty much uniquely Berlin thing who is overworking their bureaucracy)

The vehicle processes are currently being overhauled. Vehicles can now be transferred online if the original registration was after 2015 and you own an electronic ID. More such processes will be coming shortly in all parts of administration.


See here: https://allaboutberlin.com/guides/anmeldung-in-english-berli...

It shouldn't have to be a 3 page guide, but there's enough variation in the process to warrant it. 5 years ago, just getting an appointment was an adventure.


Consumer aesthetic preference. Enabling a revenue stream for small business. Reducing burden on already-overloaded passport office. Enabling remote applications for passports, e.g. there is not a passport office in every city of a large country.


The funny thing is, the local zoo had no problem taking your picture and printing it onto a all-year ticket 15 years ago, but I found it quite annoying that you are required to bring your own photo when applying for a new passport. As I went through renewing my passport some weeks ago, having your picture taken with a webcam in the office would ad no complication to the process - any aesthetic value is lost by the time it is on the passport anyway.


The local zoo is rightly substantially less concerned about forgeries than the State Department.


And yet, the local zoo took the picture themselves in a process under their control, while the passport office doesn’t, but accepts pictures from external sources. That’s the point.


Professional photographers don't have a significant fraction of their business coming from zoo photos. They do for passport photos. They therefore complained about losing the latter business but not the former.


Some embassies use self-service robot/kiosk.


> there is not a passport office in every city of a large country

My little suburb of 20k people has a USPS employee who handles them. Should be entirely possible even in rural areas.


Nope. I know people who would have had to drive two or three hours to a USPS location that could do passport photos. And then, it's only done for a couple of hours a day, one or two days a week.

Instead, they went to the photo department of the pharmacy 15 minutes away and got it done.


USPS taking the role on primarily would likely entail expansion of the services to smaller post offices, like the one in my wife's old town of 400 people in the middle of nowhere.


In Germany, there is. At least on per county (Landkreis) or larger city. Also, every / most major airport has one for emergency cases.


In many countries, passport applications are conducted remotely, either by post or online. Passport offices are few and far between, and you would only use them if you needed one the same day, and would pay a large premium do so.


Some people really take pictures seriously and will spend a lot of time taking pictures until they are satisfied.


They take driver's license photos at the DMV... they don't even let you review them, they just snap them and that is what you get.


Until this law you could simply bring your own picture for German passport/ID and the clerc taking the application would maybe eyeball you for verification, unlikely to reject anything but the most obvious fakes. Handing in a picture of Mickey Mouse wouldn't just get rejected if they have a particularly bad day, but anything somewhat plausible would likely get through.

Driver's license is an even lower standard iirc, because it isn't abused as an ID in everything but name. Driver's licenses merely document qualification and most don't even expire so you will occasionally see some frail elderly person hand around their licence to show off how they were looking at 18 years old.


I wonder if they can equip the passport office with software that compares your face with the photo; software face recognition is based on measuring the geometry of the face, and if there are strange differences (that the human eye can't see), the software should flag it..


It was big surprise to me that in a lot of European countries, it is possible to apply for passport by post


Probably hinges on mandatory ID: once you have that, the passport is hardly more than a copy into a slightly different medium.


It's possible in Ireland, which doesn't have mandatory or even widespread government ID. You can even apply for it online.


Every dmv I have been to has always asked or offered an option to review my photo. It also helps to be appreciative of the plight of the person at the counter. It’s their daily job so they can bend a little when getting to the more exciting part of their work


In some states, the DMV uses the photo you took during your permit test. Clueless 15 year olds show up with messy hair to take the written test, get their photo taken and now that photo could be on your driver's license till your 30s. DMV lets you renew your license by mail without a new photo sometimes.

My license has a picture of a 15-year-old with the height and weight that's quite different from my current self..


I can't imagine any picture I'd care less about. The US CBP officer who took my picture for my Nexus card with a handheld webcam didn't even get my head entirely in frame.


I'd expect the passport agent to be empowered to say "no" to that.


That's why it is allowed to use a photo taken by a professional photographer.


Yes, I know that's why. If that's a security risk, though, I'm saying I don't really mind if it's an official passport agent who has to take the photo, and giving them to power to say "suck it up, it's not a fashion shoot" to avoid drawing things out.

DMVs already do this for drivers' licenses. It's odd that passports don't work the same way.


Passport renewals in the US can be done via mail, so you are never in the passport office to take a photo.


Don't they take fingerprints for American passports? They do for the French ones so you have to be in-person, but they still expect you to provide the pictures yourself oddly enough. You can use an accredited photographer or, more commonly, one of these automated photobooths you can find in train stations and shopping malls.


In Germany they do as well. So yeah, in person. Don't ask me how that works for handicapped people and elderly not able to move.

They don't safe your prints anywhere else then your passport or ID, so. Theoretically, you can get a passport with your picture for a different person. Very theoretical, and also very illegal. As long as the picture was within spec for biometric pictures, it was ok to bring your own.


To be fair, a passport is only needed to travel outside of the EU. Elderly that can't make it to an office to get the passport will have an even harder time actually travelling outside of the EU.


You'll need state issued ID if you want to set foot in Belgium, EU citizen or not. You can be fined for walking around without ID. I suspect other EU countries have similarly disgusting laws.

Your point about people who can't leave their homes still stands.


Most EU countries I know have similar laws. Not sure why that is disgusting so. In Germany you have to identify yourself with a valid ID within 24 hours, if I remember well. Usually you have your ID in wallet anyways.

EDIT: As every resident has a primary residency address registered, this also serves as, what in the US would call it, voter registration. No purging, no tempering, not separate registration. You just get the papers by mail to your primary address. Works as well for EU residents for local elections.


I have never had my fingerprints taken for my American passport. For my Croatian passport, I had to go to the consulate in Los Angeles (halfway across the country for me) to get my identity verified and my fingerprints taken.

But, if you live in Croatia and the police already have your fingerprints from previous passports (along with you having an electronic ID card, which is standard and required), you can get a new passport quickly by applying online in the “e-gradani” or e-citizens service.


You have to send in your old passport and a new photo... you have to go in person for your first passport.


The US does not take fingerprints for US passports. Not yet, at least.


What's the biometric data on the RFID passports? Just encoded versions of everything in the physical book? Including photo?

I had my prints taken, but it was for Global Entry IIRC. Agreed that I've never submitted prints for a US passport.


Not when you first get them, but I think they're collected when you travel.

I know I've had my fingerprints scanned at the border a number of times. I'd be surprised if they weren't added to the record somehow.


I've traveled to several countries outside the U.S., and never had my fingerprints taken, even at border crossings which required seeing my passport.


Things are changing and more and more countries around the world are requiring fingerprints at least at airports. For example, Peru and Senegal both required me to give my fingerprints when flying into their main airports.


Quite normal for me with UK passports, to be fingerprinted.

Some countries (Russia comes to mind) require you to physically go to the visa centre to get fingerprinted as part of the visa application, and then again when you arrive at immigration

Other places where visas are online, on arrival, or not needed at all, tend to fingerprint at the border -- the U.S, Singapore, etc.

We currently don't need to get fingerprinted in the EU, but we decided to remove our freedoms so not sure if that will change next year.

Getting fingerprinted is such a common thing that I can't remember many specific countries requirements.


Just FYI: It is generally required for EU passports to have fingerprint biometric data. From the Wikipedia page, passports of the European Union:

Only British and Irish passports are not obliged by EU law to contain fingerprint information in their chip. With the exception of passports issued by Denmark, Ireland, and the United Kingdom, all EU citizens applying for a new ordinary passport or passport renewal by 28 August 2006 (for facial images) and 28 June 2009 (for fingerprints) should have been biometrically enrolled. This is a consequence of Regulation (EC) 2252/2004 in combination with two follow-up decisions by the European Commission.



I've had them scanned for Global Entry in the US (and when I return into the country using Global Entry). But as a US citizen I wouldn't otherwise be scanned entering the US.


I've pondered putting some high-resolution scans of my fingerprints on my GitHub page for plausible deniability of anywhere my fingerprints might turn up.


The enhanced credentials you can get, such as "Global Entry" require an interview and fingerprints. Global Entry cards make it comparatively easy to return to the US via Miami in my experience.


Neither US nor Canada requires fingerprints for passport issuance nor renewal.


No


This was the original plan but it was dumped because of photographer lobbying. IMO a good idea because it helps small business owners. The passport office's capabilities to create photographs will be expanded as well though.


I had one taken ten years ago with a Polaroid camera. It ended up overexposed and barely legible but it was still accepted.


> The government on Wednesday backed a law requiring people to either have their photo taken at a passport office or, if they use a photographer, have it submitted in digital form over a secure connection

Is there already a list of approved photographers who would submit directly, i.e. effectively "signing" the digital photo bitstream? What would be the qualification process for such a photographer? Who is liable if the photographer's computer is hacked and the image tampered prior to uploading?


Can I see any samples of digital doppelganger photos. The one on the website does not like a photo of 2 separate people.


Here's a ten year old art project where they did that: https://artoftheprank.com/2010/06/19/ztohoven-art-collective...

There's a video link in the page.

Our government reacted precisely the same - passport/national id offices now have cameras.


Well, that's the point.

> Such manipulation of photos is typically invisible to the human eye, the researchers found.

(The picture in the article is just a file photo of a passport, though. Not an example of the manipulation.)


Is this some sort of adversarial image? Wouldn't it only work on specific neural networks?


It works on the neural networks inside people's skulls. The point is a passport control officer would wave either of two distinct people through based on the same photo.


This isn't related to fooling humans. There is no passport control officer.

Immigration use automated barriers and facial recognition to match the person to the digital photo on the passport chip.

The trick in the article causes the facial recognition algorithm to accept two different people for the same passport.


About a decade ago we had iris scanning at London Heathrow. You had to register upfront, and the idea was only frequent flyers would be registered, but it was great, the lines were short - you didn't even need to get your passport out.

It started getting a bit silly towards the end as unregistered people started clogging up the queues, but it was far faster than the "automatic passport scanning" stuff.

Surely that was harder to forge than a passport photo. I assume the company in charge didn't offer enough bribes to the politicians making the decision.


The trick also fools humans who still exist at all borders, including at automated gates (where humans get to see each comparison although I can't imagine them being to attentive at the end of their shift).


Adversarial against humans; it sounds like the idea is to take two people who already look somewhat similar and produce a photo which as best as possible looks like either.


That quote strikes me as an incorrect interpretation of whatever the researchers said


It fascinating seeing the different passport requirements by country.

It's a well known fact that intelligence agencies will use other countries passports as cover. Israel is well known for this. Which countries would you use? Well, a US passport isn't going to be a good cover in many countries, so it's often more neutral countries like Canada, Australia, Sweden.

Canada has tightened up their passport requires a few times after a rash of stolen and forged Canadian passports.

Smaller countries with less security issues have much more lax passport requirements. A friend was able to get a Vietnamese passport through her mom. She brought original birth certificates, etc. They were fine with just photocopies (that could obviously be changed).


> pictures of two people are digitally combined, making it possible to assign multiple identities to a single document

Wild, I wonder how often this has happened.


I had to renew my German passport last year.

I live in Buenos Aires (I'm from Argentina) and the embassy refers you to a couple of places where you can get your photo taken.

I went to the place that was close to a bus stop in the bus line I was using to get to the embassy.

It was a rather badly lit shop; I asked for them to take me a photo for the passport, and they did it with a rather lousy cellphone, and printed it right away in one of those auto machines that you can see everywhere you can print digital photos. They guy cut it with scissors.

Guess it goes without saying that it was of very bad quality; and yes, that is the picture that is now in my passport.

I do not need to alter it in any way, it's so bad probably my brother could enter Europe with it.


> The government on Wednesday backed a law requiring people to either have their photo taken at a passport office or, if they use a photographer, have it submitted in digital form over a secure connection

So photographers are still able to submit doctored photos. If they really want to stop this practice, the government must have full ownership over the chain of custody of these pictures (including hardware and software), OR be able to detect morphed pictures that are submitted by anyone.

In my opinion neither of these strategies will be implemented in practice, so this new law seems pretty pointless.


If a photographer is caught sending doctored photos (easy to detect after the fact, especially if the photographer does many of these manipulations) they'll be in deep legal trouble.

As often, why bother with an overcomplicated technical solution when a social one will do the trick just fine? Oh, who am I kidding, let's just use the blockchain instead!


Yeah, there are a lot of absolutely terrible solutions just screaming to be digitally solved that just don't get solved because the minor road bumps put in place make it juuuuust to hard to bother with the vast majority of exploits.

Look at notarizing documents. It's laughably insecure. It's just a stamp that lists a notary's name. Hiring a notary to work for you and expecting them to notarize documents for you, their boss, is completely normal and not seen as any sort of conflict of interest. Obviously a notary would quit their job rather than agree to backdate a document a day or two for the boss, right? Of course. And, despite the technical ease of making digital copies of documents or recording notary entries with timestamps or something, notaries tend to use a log book, and sometimes they just let the user fill it out themselves. In many states, the log book isn't even a requirement. And then there's the stamp. There's no standard for what it needs to look like, no secret token, it's just the words "notary public" and the name of a notary. And the names of all the notaries are listed on a public website somewhere. You can order a notary stamp on Amazon. And even if everything were impossible to fake, satisfying a notary of your identity is crazy easy. In many states, you don't even need your own ID, you can show up with someone else who has their own ID and have them vouch for your identity. And in many states the notary wouldn't even need to write down who that other person claimed to be. The whole system is absolutely screaming for digital reinvention, potentially including, yes, blockchain.

And yet, the system still mostly works just fine. A notarization is generally seen as pretty good evidence of something. People have some confidence in them. Folks you do business with will ask you to send them notarized documents. That's because most people who'd be willing to forge someone's signature in the moment aren't willing to go through the extra effort of faking a notarization, even though it's not a very high bar. And so it all somehow works, kind of. Weird, right?


The same deep legal trouble applies to individuals sending manipulated photos, though.

And if you are a criminal who wants to obtain a fake passport, it's probably not out of your reach to use social engineering to convince your photographer to plug a USB stick with malware into their computer.

It does raise the bar of difficulty slightly, but it also gives criminals plausible deniability.


I once needed a new ID card as I lost my old one and the passport wasn't valid anymore. I also moved to a new city just before.

In order to get a new ID card, usually you hand in your old one, all I needed was a copy of my birth certificate and the registration in tje new city. The latter was easy, as in Germany registration and passports / IDs are done by the same office. The latter one was 10 Euro in stamps, 3 days later I had the copy in my postbox. Out of experience, your name on the box is enough.

So, theoretically you could get a new ID, with your picture and prints, but a different name, by ordering a birth certificate and have it mailed to you. No idea what kind of checks where built in in the background, but I hadn't the impression there were a lot. Germany, like 8 years ago.

Wouldn't work on scale, so. And way to risky for a one-off.


but individuals can do this alone without getting caught. But the progessional has to be involved with clients. If the professional is known to provide this service, the troubles for him follow. There is also the mystery consumer possibility. It's far far easier to catch.


Thats not the only way you can fool facial recognition systems. You can get clear glasses that when put on will fool the system into seeing a different face.

See https://www.cs.cmu.edu/~sbhagava/papers/face-rec-ccs16.pdf


I have recently renewed my passport in Germany and took the photo at the passport office. The photo was printed out by a machine next to the entrance from which I carried it up two stairs to the clerk. While the new law was not in place at that time yet, it would have been trivial for me or any person going to the lengths of combining faces in a photo to adjust the layout of my own print to the one done by the machine and add its logo to it.


That's how it was done now for a long time. The new machines send the picture electronically to the clerk and don't print them anymore.


Awesome.

Until now, you could take your passport photo conveniently at home for next to nothing. I'm sure they will introduce exorbitant fees for a simple picture now.


I wonder how this will affect the subway station photo booths.

For those that don't know, at least in Berlin (possibly other places) many U-Bahn (Subway) stations have photo booths for passport photos. They're apparently verifiable by the government, but I've never really understood how.

This sounds like those booths will no longer work. Anyone have any more info?


Eh, going to all the trouble of manipulating the photo and getting around Germany's laws are a waste of time.

All you do is go to Belgium, and bribe a local mayor, where they have the ridiculous system of having local administration and control over the issuing (and mysterious "loss") of passports. Belgian passports are rife with fraud.


Yes they are issued by the cities (so pictures and fingerprints are taken there) but are of course created by the interior ministry, not by the cities themselves as far as I know. Same for the national IDs.

Are there particular evidence of fraud ? It's the second time I see this comment recently. Belgium has the Registre National where everything is centrally stored (including passport data, you can see all passports and IDs issued in your name there for instance), it's not totally a city-by-city thing.


Some other European countries already require in-office photography. Hungary is pretty strict about this, most Hungarian embassies will take your photo and fingerprint to issue you a tourist visa. They just use what looks like a webcam.


This is the paradox of Solow pushed to the next level. You see digital stuff everyhwere, except in the balance sheet... because everytime you use digital technologies to simplify something, it ends up complexifying something else :D


In Indian passport offices, we cannot bring the photos instead there is dslr hooked to the computer to take photos when i went to take passport in 2010.


Are there any examples of "doppelganger" photos online? Now I'm curious about what Germany is using to do the matching.


I have an appointment to get a new (German) passport next Week. I'll be curious if this will be in effect/applied by then.


When I had my passport picture taken, it was in a booth with software that assured the resulting image conformed to all the rules.


Today in eigenvectors...


The whole paper passport thing is just ridiculous in the age of ubiquitous digital communications and photography. Any official requiring your picture could take it and send it to an AI for identification right on the spot.


Easy in a "stable" situation like an airport with all the material.

Harder in anything less than a perfect environment. Now what about between non-friendly countries. In a warzone. On a road checkpoint. For the random checks at the gate of the plane or in the middle of the boarding process (for flights to the US they check it both at the gate and on the "boarding platform" now). At least the paper things provides "something" when that's all you have to ID someone.


And what would be gained by that except spending a lot of money, needing to train existing officers and being reliant on a working internet connection?


> train

In most cases this would amount to simply pressing a key and reading data off the screen.


There's currently no national database storing pictures of all German citizen, and I for one would oppose its creation.


Why would you oppose the database of all citizens to also having pictures in it?


It's a step on the road to mass surveillance.


There is also no single database of all German citizens. Privacy is very important in Germany.


There is since 2007, at the Bundeszentralamt für Steuern.

In addition, many decentral databases (such as local registration databases) can be comprehensively and automatically queried by many individual authorities.


There is. Its just not official.


Source?


Judging by the links throughout this thread and the posted article, that isn’t foolproof either.


I agree, and having a barcode on the back of the neck would serve the purpose better.


German passports have fingerprint info stored in them - won't that prevent someone else from being able to use the passport? I would hope they check fingerprints at the border.


I'm an American expat in Germany. I've never had my fingerprints checked, neither in the US not at any country borders. Could be a privilege stemming from US/EU diplomacy but I've never heard of them checking anyone else's fingerprints.


For foreigners entering the US fingerprints are taken in ~100% of the cases at airports. Land borders seem to be an exception.

For the EU it's very rare as far as I know, both for EU citizens or foreigners.


> For foreigners entering the US fingerprints are taken in ~100% of the cases at airports.

Not for Canadians - unless this recently changed, fingerprints are not taken for a Canadian flying in from Canada, or from Mexico.


Interesting. I'm a student from Europe. All of my international friends have the same experience. But Canadian have a very special relationship with the US (like few/no visas...) so I guess I'm not surprised.


Which is fortunate in the EU given the automated passport gates. I can't imagine trying to get Opa to scan his fingerprints in a way that satisfies the automated checking.


EU citizen here; I had the fingerprints checked at US borders.


Last time I renewed my passport finger prints were optional. If you want to visit certain countries like USA you must provide them but you are not generally required.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: