Executive Summary
National Audit Office Value for Money Report
This report examines the Identity and Passport Services project
to introduce ePassports. An ePassport contains an electronic chip
and antenna, to store and transmit to an electronic reader the
passport holders digital photograph and biographical information.
The chip also contains an electronic signature confirming the
issuing country and the integrity of the data to provide extra
checks at border control. The budgeted set-up costs for the project
were 63 million, and marginal production costs from 2005-06 to
2010-11 are estimated to be 195 million.[Footnote
1]
Rather than put a new contract for ePassport production out to
competition, the Agency invoked an exemption from procurement
regulations on security grounds which offered it the option of
amending its existing supplier contract for digital passports to
incorporate ePassport production. The Agency chose this route
because of delays in evolving international standards on ePassport
design and substantial compensation costs would have been payable
if the existing contract were to be ended early. The Identity and
Passport Service took steps to secure value for money in the
amended contract terms. However, longer term risks to value for
money remain due to the technical novelty of ePassports, the risk
of organisational knowledge loss and potential problems using
electronic readers at border control.
Main findings
- The Identity and Passport Service managed the implementation
project successfully, delivering it within budget and to a
timescale that ensured the UKs continued participation in the
United States Visa Waiver Program. The Identity and Passport
Service undertook a gradual switch from digital to ePassports and
met the majority of its customer service targets during the
transition.
- British ePassports meet international standards on ePassport
design and have demonstrated their interoperability in
international tests.
- Although it has been tested in laboratory conditions, the
ability of the chip unit[Footnote 2]
to withstand real-life passport usage is unknown. The chip units
have a two year warranty but British ePassports are intended to
last ten years. The Identity and Passport Service is keeping this
issue under review.
- With the right equipment, technical experts have shown that it
is possible to read and clone ePassport chips. To access the data
on a chip, prior knowledge of the information contained on the
passport data page is required. But if the information on the data
page can already be seen (or is known from another source) then
there is no need to read the electronic chip since it contains no
more biographical information other than that visible on the data
page with the naked eye. New security features in the ePassport
design are intended to render impractical the creation of a faked
ePassport in which a cloned chip could be inserted. The Identity
and Passport Service told us that any alteration of the data on
cloned chips would be detected when the ePassport is read by an
electronic reader at border control.
- Future liabilities may arise from intellectual property rights
relating to the design of electronic components which are held by
contractors.
- The Identity and Passport Service spent 4.9 million on
consultants during the project. The Identity and Passport Service
recognises the need to reduce its reliance on consultants and
interim staff and to devote greater attention to knowledge
transfer. Using civil servants in non-technical roles within the
future passport development project could save 3.5 million over the
next five years and help retain organisational memory.
- There was insufficient liaison between the Identity and
Passport Service and the Immigration and Nationality Directorate
about how ePassports would be read at border control.
- The Immigration and Nationality Directorate began testing the
ability of electronic readers to cope with high volumes of
ePassport checks in late November 2006. If readers cannot cope, the
full benefits of ePassports may not be realised.
Recommendations
- To manage the risks to value for money, the Identity and
Passport Service should:
- analyse the costs and benefits of a negotiated increase in the
chip unit warranty and revisit this issue, and the question of
passport validity, as more evidence of durability emerges;
- test the market as soon as possible for potential suppliers to
compete for the new contract for ePassport production which will
begin in October 2010;
- clearly document the basis for claiming any future exclusion
from procurement regulations;
- reduce expenditure on technical consultants by using
alternative methods of remuneration such as fixed-price contracts
and bonuses for work delivered, rather than paying daily rates;
and
- reduce expenditure on non-technical consultants in project
teams by: developing a sustainable core of in-house project
management skills to be supplemented with external specialists when
required; and employing permanent staff rather than consultants to
perform business analysis and administrative functions.
- To increase effective working between government departments,
the Home Office should:
- oversee the sharing of technical expertise between the Identity
and Passport Service and the Immigration and Nationality
Directorate to ensure the forthcoming upgrade of readers at UK
Immigration is timely and enables prompt reading of
ePassports;
- aggregate the purchase of biometric consultancy, readers and
other equipment across the Home Office, appointing a lead purchaser
who could also act on behalf of the Foreign & Commonwealth
Office to secure better prices; and
- manage any future upgrades to ePassports as a cross-agency
project encompassing the Identity and Passport Service, the Foreign
& Commonwealth Office and the Immigration and Nationality
Directorate with a Senior Responsible Owner, a single project plan
and project board.
- [back from footnote 1] In this report
the marginal cost of ePassport production refers to the additional
cost of producing ePassports over and above the costs of those
elements which would have been contained in digital passports.
- [back from footnote 2] Throughout the
rest of this report the term chip unit will be used to denote the
chip, its operating system, the antenna and the plastic covering in
which they are all housed.