Most authorities would agree that one of the main challenges they face is coming from sophisticated fraudsters seeking to tamper with legitimate passports.
A variety of tools and techniques have been employed to address just this threat. However, criminals and other malicious forces remain as determined as they are ingenious.
To ensure the integrity of passports, the design of one particular component – commonly known as the data page hinge – plays a key role.
The hinge is responsible for attaching the all-important
passport data page, also known as the
biographical page, to the rest of the booklet.
So getting this aspect of passport construction right can create a huge obstacle for anyone hoping to insert a fake bio page, or modify the existing one.
For this article, we slapped on our lab coats and decided to test everything.
- We reviewed 110+ passports
- We anatomized 43.
In the end we discovered
3 main factors that need to be taken into account when specifying a hinge. We also looked at the potential issues raised by the use of polycarbonate data pages and the solutions adopted by countries.
Finally, we identified which of these approaches represents the most effective weapon in the on-going fight against passport fraud and forgery.
And in today's guide, we are going to show you everything we learned.
So what's the real story here?
Readers familiar with the 7th edition of ICAO 9303 will know that part two of the publication lists the main threats to
machine readable travel passports.
One of them is the removal and substitution of entire pages.
Naturally, the top target for fraudsters is always likely to be the data page, which contains the genuine holder's personal details.
Over the last decade, a growing number of countries have adopted passport bio pages constructed from polycarbonate. As we explained in this recent article on passport secure design, polycarbonate provides some important security benefits. However, given that the hinge (also known as the sleeve or flap) is the section that links the biographical page with the rest of the booklet, securing this aspect clearly represents another vital part of passport security design.
But when it comes to creating the hinge, it is important to remember that
security is not the only factor that needs to be considered.
durability must also be taken into account.
Now let's consider passport flexibility
- From the user's perspective, flexibility is important because it means that the booklet opens flat for easy checking at border control, but closes completely to maintain privacy.
- For the manufacturer, flexibility is a major concern because the hinge must integrate easily into the bookbinding process.
And what about passport durability?
Any passport booklet must pass ICAO minimum durability tests. This includes the Physical Damage Evaluation Method, with mechanical stress applying force of 60N (Newton) an attempt to tear the passport bio page.
After being subjected to these tests, no part of the passport data page should be missing and more than 90% of the binding must be intact.
To demonstrate the level of durability that can be achieved, here is a member of our lab team suspended from a passport by nothing more than the hinge. In this example, several hundred N are being applied. (Newton)
Don't try this at home!
Now on to security
As far as the hinge is concerned, an obvious threat is the removal of the data page and the integration of another passport booklet. Even more worrying is the use of the hinge as a potential entry point to attack the data page and replace genuine personal data with forged information.
There is a fourth factor, which is the ease of handling, specifically for document manufacturers, who integrate it in their manufacturing process. It relates to the adaptability to various types of lamination processes (platen press or continuous roll) for ease of collation, suitability for various cycles of lamination and ease of sewing into the booklet.
Passport hinge attacks: here's the battle scene
For fraudsters, one potential opportunity is to
cut the hinge along the original passport bio page and then paste in a falsified replacement.
Alternatively, they'll try to
slice the data page to swap genuine personal information with fraudulent details. Common methods include using hairdryers, or a scalpel to create a
split, starting at the edges of the page. Sometimes attempts are made to weaken the data page first, using chemicals or extreme temperatures.
To counter this, any small initial cut in the hinge must not weaken the structure of the data page. The hinge must be constructed in such a way that does not allow the cut to spread easily, allowing the data page to become detached from the booklet.
So why does polycarbonate create a paradox?
Polycarbonate is a fused material. It becomes a mono block after lamination. With printing and personalization on different layers inside the body and a tactile surface, it is highly resistant to splitting attacks.
The paradox lies in the fact that, whilst polycarbonate offers outstanding data page security, it is not flexible enough to act as the hinge as well.
Some approaches to polycarbonate data page construction address this by using a different type of plastic at its core. This can then extend to form the hinge. However, this means that the passport data page is no longer 100% polycarbonate and therefore not a single block of delaminable plastic.
The introduction of a second material introduces a
vulnerability: the possibility of delaminating the bio page and accessing the personalization data it contains, as indicated below.
To avoid compromising security, non-polycarbonate material must only be used as part of the data page construction in a way that does not weaken the data page structure itself, whilst remaining securely attached.
What's the answer, then?
The 3 main approaches to constructing hinges for polycarbonate passport data pages:
Hinge attached to the side of the data page
Using this technique, the hinge is attached to the side of the data page, either with mechanical elements such as pins and holes, or using ultrasonic welding.
First, the good news
A hinge that is only attached to the top part of the data page offers good security; it does not compromise the passport bio page's integrity. This sort of attachment is more usually done with ultrasonic welding. This uses very high frequency vibration to heat up the polycarbonate and hence help to embed the component within it.
Here's the catch
Rigidity can be an issue. This approach impacts
negatively on the flexibility of the data page, preventing proper opening and closing and posing problems in terms of manufacturing. It can also create a point at which the data page can be cut out.
But these security concerns can be addressed
Even if the genuine bio page is removed, attaching a new one is very difficult. When combined with tamper evident features (such as printing a special pattern on the hinge in visible and invisible inks, embossed text and laser engraved data) any attempt at replacement becomes readily apparent.
UV printing can also be employed to leave obvious traces of tampering, when the document is shone under a UV light.
personalized hinge further
enhances the level of
At present, 16 countries are using a passport with a hinge attached to the side of the data page.
Hinge integrated all the way across the data page
With this approach, the hinge is not partially embedded into the document. Instead it forms an entire layer of the document: either attached to the side or in the middle of the structure.
Here's something important to think about
Some integral hinge data page constructions use a different material as the core of the bio page and this core then extends and forms the hinge. With these types of construction the data page is no longer 100% polycarbonate and therefore not a single block of undelaminable plastic. This type of hinge usually lacks security because it weakens the structure of the data page and facilitates fraud.
The position of the hinge
creates a weak point that can allow the data page to be split.
Hinges that are attached all the way across the data page lack security if the adhesion between the Polycarbonate and the hinge material is weak. The second material should be one that is crosslinked to improve thermal tampering resistance as well as designed to bond strongly with the Polycarbonate, making delamination very difficult.
Hinges attached to the side of the data page across its entire length can also make it possible to hide counterfeiting attacks. Potentially, a fraudster could remove the hinge, modify the personalized layers of the data page, and then hide it back inside the passport booklet.
There's no getting round it
Because it is not 100% polycarbonate, this solution also usually makes the slicing type of attack easier. Admittedly, some techniques do use polycarbonate, and are milled. However, this does not correctly address the issues of hinge flexibility and durability. On the plus side, this approach can incorporate tamper evident features.
At present, just 6 countries are using this method of passport construction.
Lately, we have seen some improvements in this type of construction, with some crosslinked material, which rectifies some key weaknesses in other integral hinge solutions as it is flexible and durable.
Hinge partially integrated inside the data page
Here the hinge is inserted into the data page, but does not go across its full length. As a result, it does not create weaknesses in the structure, or facilitate slicing.
In theory, compared to an external hinge, fraudsters may perceive an angle of attack. However, if fused properly, this technique does not open the door to slicing by weakening the structure. The use of feature holes in the hinge material will provide better adhesion of polycarbonate layers during lamination.
The potential benefits don't stop there
tamper evidence is achieved when the hinge has a visible area between the data page and the stitching. Indeed, many of the passports that use this type of hinge incorporate tamper evident features, including:
- UV printing and/or UV threads in the fabric
- Precisely aligned patterns
- Combination with offset printing which will be destroyed if the data page is removed
Currently, 21 countries deploy passports using this hinge design.
So what's the conclusion?
First, here's a quick reminder of the 5 key qualities displayed by an effective hinge for polycarbonate data pages:
- Does not compromise the construction of the data page or the security elements within it
- Is made of a durable and flexible material that passes
- Can be firmly and securely attached to the data page and booklet, and backed by effective countermeasures
- Is near-impossible to manipulate without leaving visible marks
- Includes features that make a replacement more visible
Finally, how do the three options compare?
hinge integrated across the whole data page is the least convincing choice.
From a security perspective, it has significant drawbacks. This approach weakens the data page structure and can facilitate slicing. Furthermore, it is not very flexible. Finally, there are question marks over its durability, since its structure usually features a lower percentage of polycarbonate. All these concerns are reflected in a low rate of adoption in the passport market.
The hinge integrated across the whole data page usually has drawbacks from a security perspective, since it weakens the data page structure and can facilitate slicing. It is not very flexible either and durability is a question mark.
Lately, we have seen some strong improvements in this type of construction, with some crosslinked material, which rectifies some key weaknesses in other integral hinge solutions as it is flexible and durable. It also bonds well with Polycarbonate, enabling making tampering with heat more difficult in addition to being flexible and durable. Used in conjunction with certain security elements on the hinge or on the data page, tampering will be evident. This is a much better product.
hinge attached to the side is a significantly better option, and is only really let down by its compromised flexibility. It offers fairly good security, since it does not bring any weakness to the data page structure and usually features some tamper evident elements. It enjoys strong levels of adoption by governments.
Top position, however, goes to the
hinge partially integrated inside the data page.
Crucially, this approach does not create weakness in the structure, or facilitate slicing. Feature holes in the hinge material offer better adhesion of polycarbonate layers during lamination, and many applications include tamper evident features.
In a world in which border security is a major concern for so many, reassurance can be found in the fact that almost half the governments currently deploying a polycarbonate data page in their passports have adopted this 'gold standard' of hinge design.
It's time for us to take off our lab coats.
More on data page security can be found in our 7-step guide on passport security design.
Stay tuned for the next edition of
More tips on secure passport design dedicated to "paper matters".
Now it's over to you
Do you have a comment to share on passport hinge? Want to find out more?
Do not hesitate to contact us with the form below. We'd also welcome any suggestions on how this dossier could be improved, or proposals for future articles.
We look forward to hearing from you.
Mobilize Gemalto secure document expertise
Gemalto enables both public and private sector institutions to combat identity fraud.
Active in the field of secure documents for over 150 years, Gemalto continuously innovates the market as the world leader in digital security with 2016 revenues of €3.1 billion.
Our 15,000 employees operate out of 99 offices, 34 personalization and data centers, and 24 research and software development centers located in 46 countries.
In the public sector, Gemalto provides secure documents, robust identity solutions and ID verification systems, border management and biometric solutions and services for more than 100 government programs worldwide including 30+ ePassport programs.