The United States authorities is infamous for taking a “better late than never” strategy to its tech rollouts. Following that custom, US Customs and Border Protection (CBP) confirmed right now that after 16 years it has lastly carried out the necessary software upgrades to verify the cryptographic signatures stored in passport RFID chips. 

Since 2006, the United States and plenty of different international locations have embedded these little chips within the again panel of their passports, or “e-Passports” as they’re recognized. The chip digitally shops the personally figuring out info of the doc’s proprietor, together with identify, date of beginning, passport quantity, and biometric knowledge like your picture, together with a cryptographic signature meant to behave as a test in opposition to tampering or forgeries. For years, the US has required that Visa Waiver international locations difficulty e-Passports to their residents who need to enter the US. Yet in all this time, CBP hadn’t really deployed the software program to execute these validity checks.

In early 2018, US senator Ron Wyden of Oregon and former senator Claire McCaskill of Missouri wrote a letter to CBP calling on the company to implement the cryptographic verification, provided that the RFID e-Passport infrastructure had been in place for years. Last week, 5 years after that request, CBP knowledgeable Wyden’s workplace that it has had the e-Passport verification system up and working since June 2022. 

CBP says that to this point the validation course of has checked greater than 3 million passports from Visa Waiver program vacationers and has “contributed” to the arrest of 12 individuals who had been allegedly trying to enter the US with “fraudulent” identification.

“During primary processing, the e-Passport technology alerted on the documents, and the travelers were referred to secondary where CBP officers determined that the travelers were in possession of fraudulent travel documents,” the company says in a press release.

“Upgrading passport security is a commonsense way to ensure people entering our country are who they say they are. It is already making America safer, without resorting to invasive searches or massive databases of private data,” Wyden says in a press release to WIRED. “I commend CBP for following through and ensuring forgers and criminals can’t use fraudulent passports to skate through security at the border.”

Though the verification has been working since June, CBP says that it nonetheless cannot confirm e-Passports issued by Andorra, the tiny nation between Spain and France that has a inhabitants of fewer than 80,000 folks. Other than that, although, CBP is working the validation checks for all Visa Waiver international locations.

“This was a major investment by the US, so I’m glad to see that they’re using these capabilities and that they work the way they’re supposed to,” says Matthew Green, a cryptographer at Johns Hopkins University. “This system is really just a basic check to help catch people traveling with forged documents, which is something we have an interest in doing. And it is not nearly as intrusive as face recognition or other systems being rolled out at the border, so overall this seems like a good system to have active.”

A 2010 Government Accountability Office report laid out the case for swiftly implementing signature verification for e-Passports. The US Department of Homeland Security (DHS) “does not have the capability to fully verify the digital signatures because it … has not implemented the system functionality necessary to perform the verification,” GAO wrote on the time. “The additional security against forgery and counterfeiting that could be provided by the inclusion of computer chips on e-passports issued by the United States and foreign countries … is not fully realized.”

More than a decade and a half later, e-Passport digital signature verification is lastly one thing DHS can test off its to-do checklist.