33

My question is what information other than the one on the main page of the passport is stored on the chip. E.g. does a spanish passport chip contain information about everytime I travelled abroad with my passport even if it did not require a visa? Does it contain information such as marital status and home address?

4
  • According to fnmt.es/productos-y-servicios/tarjetas-electronicas/… the chip contains the biometric data relative to the holder's facial features, as well as personal data that are included in the OCR lines of printing – Traveller Apr 17 at 9:24
  • 6
    This is highly variable depending on the country. Some also contain the photo, others contain fingerprints (a variable number of them), some both. In many countries it also varied over time so it may depend on how old the passport is. Travel data is usually held in servers rather than in the passport. – jcaron Apr 17 at 10:18
  • 1
    Probably not on chip, but in some shared system or other. There are many many databases/systems used for sharing information between states/countries. Examples from E.U. include Interpol databases, Europol databases, EUCARIS (to share information about cars between member states so that police can identify stolen cars or send information back to the state of origin about cars being used for something illegal). I'm pretty sure there are shared databases of passports and IDs (again, with access monitored for specific purposes only) with varying number of countries using and connecting to them. – mishan Apr 17 at 13:59
  • I would expect the information in the passport to be put there when issued and not updated when used (they can look those things up online). – Thorbjørn Ravn Andersen Apr 20 at 10:48
22
+500

ePassports are a subset of eMRTDs (Electronic Machine Readable Travel Documents).

The data that can be stored on them is governed by ICAO 9303 (specifically part 10 and 11). Most of the data that it allows to be stored is optional, and only required data is also printed on eMRTDs' identity pages.

From what I've seen, the data that's on eMRTDs varies greatly between country and country, and can even vary between different types of passports (such as between Regular Passports and Special Passports).

Even in the EU, there's a great variety in the sets of data that's encoded in the passports, however, in some cases I've seen countries share the same set of data (Belgium and France, iirc).

The list of files (rather, "data groups") supported by ICAO 9303 can be seen below:

List of files in ICAO 9303

Out of the ~15 types of supported data groups, only 2 are required, and these are just the information that also is visible on the identity page of your passport: DG1 and DG2.

DG5 and DG7 are optional, but they represent data that's also visible on the identity page.

  • DG1 (Details Encoded in MRZ) is just the data on the MRZ (Machine Readable Zone), which is also printed on the identity page of the passport.
  • DG2 (Encoded Face) contains a JPEG or JPEG2000 file containing your face, which is also printed on the identity page. In some cases (like in UK passports), DG2 may also contain certain information like location of eyes.
  • DG5 (Displayed Portrait) is rarely used, and matches DG2 in all cases I saw.
  • DG7 (Displayed Signature or Usual Mark) is used by some countries (Belgium etc) and includes a JPEG/JPEG2000 file of the signature on passport.

As for commonly included information that's not visible on the identity page:

  • DG3 (Encoded Finger(s)), DG4 (Encoded Eye(s)). This information usually requires Extended Access Control to access due to the sensitive nature of the data, which may not be available to all countries you visit. I've not seen any cases of DG4 (Encoded Eye(s)) being used, but many countries include DG3 (Encoded Finger(s)) if the person gave fingerprints when applying for their passport.
  • DG11 (Additional Personal Detail(s)) can contain many additional details, including but not limited to Name of Holder, Place of Birth, Address, Profession, or even an image of Proof of Citizenship (though I've never seen that one in the wild). Some passports (Turkey, Belgium, France etc) include this info.
  • DG12 (Additional Document Detail(s)) can contain information like Date of Issue, Issuing Authority, etc. This information is also provided on some passports (Turkey, Belgium, etc).

The files on eMRTDs get write-locked after the initialization process. That means that they cannot be modified after the document has been issued.

These files are all hashed, and these hashes are then signed and stored on a PKCS#11 certificate on the chip (on a file called "Security Object"), allowing detecting counterfeit eMRTDs with fake or tampered information.

All files (except for those specifying authentication parameters) require authentication to be accessed. Most authentication schemes (BAC and PACE) require document's expiry, birthday and document number to derive the keys to authenticate. This is why passport readers at border control have to read the MRZ before they can read the chip.

Some countries (like Germany and Turkey) offer additional functionality on eMRTDs, though usually these are on eIDs and not on ePassports. These are usually country-specific and are not as widely deployed.


To answer your example questions:

  • As the files are immutable for security reasons, your passport does not and cannot store your travel history. Individual governments, however, likely keep databases with your travel history and can query these with the information present on your passport.
  • There's no official way to encode marital status, though it may be encoded as part of title in DG11 or as an optional detail in DG13.
  • Your address at the time of document initialization may be stored on the document itself on DG11. While I don't know if Spain does this, I know that some other countries does this.

The only way to know what exactly is encoded in your passport is to read it.

There's a number of mobile applications that allow you to do so on your own, such as ReadID NFC Demo for Android or ReadID NFC Me for iOS. While these apps may not be able to list all the data that's encoded on your passport, they should give a rough idea on what may or may not be in your passport.

3
  • 7
    I spent many sleepless nights trying to implement ICAO 9303 on an RFID research project (Proxmark3) and it feels good to finally be able to let out this knowledge. – Ave Apr 18 at 4:31
  • Nice! ......... – Ben Bolker Apr 20 at 0:44
  • 1
    ooh, One of my jobs was at a consumer of this information. This might be useful to my co-workers if I go back :D – Journeyman Geek Apr 20 at 1:02
29

In additon to information printed on the passport document the chip stores

  • a face image in digital form (although it is the same image that is printed on the passport, its quality isn't affected by reflections, degradation over the years, dirt... therefore you could consider it as "other" information)
  • in most cases fingerprint data, and maybe other biometrical data (depending on the country)
  • last, not least, a digital signature over all digital data stored on the chip, issued by the country that issued the passport.
    This makes the data much more trustworthy than relying on the optical security features of a passport document.
    Anybody (not only the issuing country) can verify this digital signature.

By the way: the specification European and any other passports comply to is not a secret and it is publicly available (in six different laguages!): ICAO Doc9303; note that only a small fraction of what is specified there, gets actually implemented (e.g. no address in German passports; although the specification describes it).
Also reading and verifying most of the digitally stored data (not the biometric data though) of a passport can be done by anyone having the right tools (NFC reader or NFC-capable mobile and the right software; no special legitimation required).
This is not the case, however, in general for ID cards (e.g. German ID card).

Now concerning the data examples you mentioned:

  • "information about everytime I travelled abroad with my passport...": no, not stored
  • "marital status": no, not stored
  • "home address": could be stored; but then I'd expect it also to be printed on the document; e.g. German passports don't store holders home address; if you are required in your country to bring your passport when you register a new home address, then probably yes.
9
  • 1
    I can verify the digital face image is indeed on it, as it is used for digital drivers licenses in Denmark, where it fetches the image from your passport using NFC. – William Mariager Apr 17 at 18:14
  • Your point about the German ID card is incorrect. As it's a valid eMRTD, it can be verified by anyone with the right tools, it just has a higher barrier as it doesn't support BAC, but apps like ReadID can easily read and verify it. – Ave Apr 18 at 4:30
  • @Ave: That's what I meant: there is a high barrier to read German eID cards (in contrast to none for most of the passports data): Before any of the sensitive data files (containing e.g. name, birth date, address, face image etc.) can be read from a German ID card, the reader has to do a Terminal Authentication, requiring a terminal certificate. No private person ever gets such a terminal certificate. Companies or authorities have to prove their legitimate interrest in getting the permisson to read an eID card before they get such a certificate (wich will be valid only for a limited time). – Curd Apr 18 at 9:08
  • "fingerprint data, and maybe other biometrical data" - not necessarily. In the UK (yes, we're still a European country) we don't have biometric data as part of our passports. We also don't have height or weight! – David Wheatley Apr 18 at 17:36
  • 1
    @David Wheatley: ok, didn't know; so I added "in most cases" to the fingerprint section. – Curd Apr 18 at 21:30
4

Which information is stored in European Passports other than what is written in it?

In French passports, until 2008 the chip didn't contain any other information on the passport holder, then in 2008 the law changed and fingerprints of two fingers were added. Note that the chip does include a digital version of the photo printed on the passport.


Source: Décret [archive] no 2005-1726 du 30 décembre 2005 relatif aux passeports électroniques. See Article 2 quoted below:

Article 2: Afin de faciliter l'authentification du détenteur des passeports mentionnés à l'article 1er, ces titres comportent un composant électronique contenant les données mentionnées au même article, à l'exception de la signature. Ce composant électronique, qui est une puce sans contact, comporte des sécurités de nature à prémunir le titulaire du titre contre les risques d'intrusion, de détournement et de modification.

Modification from Décret n°2008-426 du 30 avril 2008 - art. 3 (mirror) (thanks jcaron for pointing it), which adds fingerprints of two fingers:

Afin de faciliter l'authentification du détenteur des passeports mentionnés à l'article 1er, ces titres comportent un composant électronique contenant les données mentionnées au même article, à l'exception de la signature, ainsi que, hors le cas prévu au premier alinéa de l'article 6-1, l'image numérisée des empreintes digitales de deux doigts.

4
  • 5
    This is incorrect, as you are referencing the origin version of the text which has been amended since. It now also contains at least fingerprints legifrance.gouv.fr/loda/id/JORFTEXT000000268015/2021-03-15 I’m not sure whether it also contains the photo. – jcaron Apr 17 at 10:15
  • @jcaron good catch, thanks! – Franck Dernoncourt Apr 17 at 12:52
  • 1
    @jcaron, I'm pretty sure it must also have the photo since French passports work at the UK passport machines which rely on that. – Dennis Apr 17 at 16:57
  • @Dennis yes it contains the photo, according to the quoted text. I didn't consider it as additional info. – Franck Dernoncourt Apr 17 at 17:04
2

With high probability, it contains exactly what is written on the hard plastic card, nothing more.
How would that other information even get there? The chip is read-only, so you would need a new passport every time they want to store that you travelled.

2
  • 8
    Some countries (principally Schengen members) passports store fingerprints electronically, which I don't believe are printed in them, but the read-only nature of the technology is important to note. – origimbo Apr 17 at 4:47
  • 2
    It's a little more complicated than just "read only", but it's safe to say nothing is currently written: travel.stackexchange.com/questions/121827/… – lambshaanxy Apr 17 at 13:05
2

In addition to the information which is also written as human-readable text and the facial image that is printed in the passport, the chip also contains biometric data such as fingerprints (one exception is for passports issued by Ireland, which do not contain fingerprints). See https://en.wikipedia.org/wiki/Biometric_passport#European_Union_/_EFTA for details.

The information regarding travels abroad is not stored on the chip (but it may exist in some government database and could be retrieved by the authorities, when needed).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.