Two-Dimensional Barcode (2D Barcode) on Passport Applications

Executive Summary

Passport Canada is a Special Operating Agency of the Department of Foreign Affairs and International Trade Canada. Its mission is to issue internationally respected travel documents. Canadian passports are issued in the exercise of the Royal prerogative. Under the Canadian Passport Order (the Order), the Minister has charged Passport Canada with the authority to issue, refuse, revoke, withhold, recover and monitor the use of passports. The Minister’s charge clearly embraces the duty to safeguard the security and integrity of the issuance process, as well as the security, integrity and value to the holder of the Canadian passport.

The objective of Passport Canada (PPTC) is to provide Canadians with quality, convenient and comprehensive passport services in a timely, secure and cost effective manner. To improve information accuracy and gain efficiency, Passport Canada (PPTC) has introduced a two dimensional barcode (2D barcode) on its Passport Applications. The passport forms that have been made available online now feature a barcode at the top right corner of the application’s first page. The barcode is dynamically generated on the form when an electronic PDF form is completed by the applicant on the screen.

Paper forms continue to play a critical role for passport application processes, even as electronic automation grows both at PPTC and its clientele, the Canadians. While paper application forms are familiar to the applicants, processing hand written forms is costly and prone to errors that decrease accuracy, creating an overall inefficiency as well as the potential for expensive errors. PPTC processes high volumes of signed application forms to meet PPTC’s security and legal requirements. The applicant either downloads or accesses a Portable Document Format (PDF) form that enables the applicant to fill out on the screen at the privacy of his home. No data or information is transmitted to PPTC. The form is simply a convenient way for the applicant to type the information in on the form, much like using a typewriter. While the form is being filled in on the screen, a two dimensional (2D) barcode is also formed on the form dynamically which contains the content of select number of fields filled out on the application form. After an applicant types data within a field that is connected to the barcode, the size of the barcode changes during encoding of the typed data. This also occurs when the user deletes data that is already encoded on the barcode. The barcode represents the encoded value of the pre-identified fields as they are typed in or corrected.

When the form is completed on the screen, the applicant must print the form on his/her printer. When the form is printed the 2D barcode is printed as part of the application form. PPTC has integrated several advisory messages when the applicant downloads the form and when the applicant completes the form. These messages inform the applicant to exit from the form properly and delete the browser’s cache as well as the Adobe viewer/reader’s cache in order to protect the applicant’s privacy. It must be noted that the form can be printed as a blank form and filled out by hand or a typewriter. In such a case the 2D barcode will not be present on the application and it will be empty of any data.

With the introduction of a two dimensional (2D) bar code on web accessible passport application forms, PPTC’s vision is to improve the quality of interaction between Canadians and PPTC with the objective of enabling Canadians to initiate their passport application request more easily while increasing the integrity of the applicant’s personal data.

The two dimensional (2D) barcode project’s scope is limited to the Adobe electronic form developed by PPTC that is capable of allowing the user to fill out the form using Adobe reader/viewer or the browser. The form further encodes a select few fields into a 2D barcode dynamically on the form. This project is to incorporate a 2D bar code on web-accessible PDF application forms.

While paper application forms are familiar to the applicants, processing hand written forms is costly and prone to errors that decrease accuracy, creating an overall inefficiency as well as the potential for expensive errors. PPTC processes high volumes of signed application forms to meet PPTC’s security and legal requirements. The applicant either downloads or accesses a Portable Document Format (PDF) form that enables the applicant to fill out on the screen at the privacy of his home. No data or information is transmitted to PPTC. The form is simply a convenient way for the applicant to type the information in on the form, much like using a typewriter. Barcodes on passport application forms contain the following fields of information:

• Surname
• First Name(s)
• Surname at Birth
• Date of Birth
• Place of Birth (City, Country)
• Permanent Address
• Mailing Address

Passport Canada officers, as per the current process, manually enter all other required data. Applicants continue to have the option of obtaining an application form at all service locations or printing one from our website to complete by hand. However, all forms completed online are making use of barcode technology.

Benefits of incorporating a 2D bar code on the web accessible PDF passport application forms include:

Faster data entry and decreased costs:

• Increased integrity;
• Increased client satisfaction; and
• More efficient and automated workflow for capturing client data.

PPTC has taken every step to ensure the security and integrity of all electronic forms posted on its website. The non-data-transmitting forms are further equipped with user prompts and messages to remind the user to protect their personal information, including steps describing how to eliminate potential security risks by cleansing their computer’s browser cache as well as Adobe Acrobat viewer’s cache. As in the case of the 2D barcode capable application forms, these forms are not capable of transmitting any data to PPTC and require to be printed by the applicant/user and brought to PPTC as hard copies.

While it is the applicant’s responsibility to protect their application prior to submission to PPTC, PPTC has adapted its two most commonly used information channels (web site and call centre), to inform applicants about these risks and has provided mitigation tools.

Passport Canada Authorities and Responsibilities

Passport Canada is a Special Operating Agency of the Department of Foreign Affairs and International Trade Canada. Its mission is to issue internationally respected travel documents. Canadian passports are issued in the exercise of the Royal prerogative. Under the Canadian Passport Order(the Order), the Minister has charged Passport Canada with the authority to issue, refuse, revoke, withhold, recover and monitor the use of passports. The Minister’s charge clearly embraces the duty to safeguard the security and integrity of the issuance process, as well as the security, integrity and value to the holder of the Canadian passport. Thus, Passport Canada monitors the passport issuance process and passport use and determines whether the entitlement requirements of the Order are being met or contravened at the time of issuance or at any time during the validity period of the passport.

The Canadian passport is an official document showing the identity and nationality of the bearer for the purpose of facilitating travel by that person outside Canada. A fundamental and cherished aspect of life in today’s global village is the citizen’s expectation of being able to travel internationally with a document that is recognized and honoured by other states. The Canadian passport carries the Government of Canada’s formal and official request to foreign states to afford free passage and assistance to the bearer while in their territories; it constitutes an act of allegiance on the part of the bearer who presumes the protection of Canada. In addition, the Canadian passport is a guarantee of return of the bearer to Canada and it assures the bearer of all the protections afforded by the Government of Canada to Canadians at home and abroad. A passport is thus more than a mere identification document and its issuance is an act of foreign policy.

All authorities vested in Passport Canada with regard to the “regular” passport govern correspondingly the issuance of other types of passport, such as Diplomatic and Special passports, and other travel documents, such as the Refugee Travel Documents issued to persons in Canada with protected-person status, including Convention refugees within the meaning of the United Nations Convention Relating to the Status of Refugees, 1951 and its Protocol of 1967, and persons in need of protection, and the Certificate of Identity issued to persons legally landed in Canada for less than three years who are stateless or who are unable to obtain a national passport for a valid reason.

At all times, the Canadian passport remains the property of the Government of Canada. This is stipulated under the Order and reiterated on page one of the passport booklet. Passports holders are thus required to take every precaution to safeguard it and failure to do so may trigger its recall and even the revocation process.

More and more passports are secondary identity documents accepted by federal and provincial ministries to prove the identity of Canadians seeking access to goods and services (health care, driver’s licences, and employment insurance to name a few). Fraudulent access to genuine secondary identity documents allows for further fraudulent and criminal activities to take place.

As a Special Operating Agency (SOA), Passport Canada fulfills a vital Federal service obligation in delivering Canadian passports to Canadians, travel documents to refugees, certificate of identity to permanent residents, special and diplomatic passports to public service personnel. The unprecedented increase in demand for passports from Canadians is due in part to the Western Hemisphere Travel Initiative (WHTI), but also reflects a general trend toward securing a passport as more Canadians respond to media coverage and increased awareness. At the same time, more stringent and complex security requirements are being required by international standards bodies, as well as Canadian and other border control agencies. In order to meet its operational and service delivery mandate, Passport Canada is required to incorporate various security initiatives into its operations and business model.

Passport Canada has four regional operations: Western, Ontario, Central and Eastern. There are 33 passport issuing offices across the country from St. John’s, Newfoundland and Labrador, to Victoria, British Columbia.

In the post 9/11 environment, Passport Canada has undergone a rapid and significant transformation from a service-based organization issuing travel documents to a security- driven organization involved in identity confirmation and international safety measures. The passport document itself has evolved, becoming a key signifier of identity and a basic requirement of participation in the global marketplace. Passports have become a primary asset for Canada and Canadians. They provide proof of identity, may offer evidence in support of entitlement to all manner of government services and benefits, facilitate international travel and commerce, support global cooperation in anti-terrorism efforts and contribute to international and domestic security.

Passport Canada was created with a focus on service delivery. However, there is increasing pressure to evolve in response to the world situation, while at the same time focusing on core services to clients. Fiscal year 2005-2006 saw a major growth in application volume of 15 %, partly attributed to the early announcement of the upcoming US passport requirement. Passport Canada continues to monitor the external environment for political and/or social occurrences that will have an impact on its business, an approach that is essential to respond strategically and prepare to meet possible changes in demand. Passport Canada maintains a commitment to ensuring that Canadian passports remain internationally respected and that Canada’s passport program is managed in a way that is sensitive to both the security and service needs of Canadians.

Security measures to protect personal information

PPTC has taken every step to ensure the security and integrity of all electronic forms posted on its website. The non-data-transmitting forms are further equipped with user prompts and message to remind the user to protect their personal information including steps describing how to eliminate potential security risks by cleansing their computer’s browser cache as well as Adobe Acrobat viewer’s cache. As in the case of the 2D barcode capable application forms, these forms are not capable of transmitting any data to PPTC and require to be printed by the applicant/user and brought to PPTC as hard copies.

As a prominent Government of Canada (G0C) agency, Passport Canada (PPTC) is a visible, client-facing organisation that employs complex IT systems to provide passport services to Canadians both in Canada and around the world. PPTC’s IT systems process and store sensitive information, which must be safeguarded accordingly. It is therefore important that risk management, and IT security practices and safeguards, be employed from the beginning while developing or modifying PPTC’s IT systems.

Development and risk management of IT systems is an on-going, cyclical process to which IT security considerations must contribute. All PPTC IT systems must conform to the organisation’s IT Security Policy, which is based on the Government Security Policy (GSP). Passport Canada’s IT Security Policy (JTSP), “provides management direction in support of PPTC’s mission and the continued delivery of services by safeguarding IT assets and information and effectively managing the associated risks.” The adoption of IT security practices and principles early in the System Development Life Cycle (SDLC) contributes greatly to the secure development, operation and eventual disposal of PPTC’s systems.

IT Security involvement in the SDLC has the goal of promoting secure system development by:

• Identifying IT security concerns and issues early in the development process.
• Ensuring IT risk management occurs throughout the life cycle.
• Meeting GoC, TBS and PPTC policy requirements.

Access controls and information integrity

The introduction of the 2D barcode enhances data integrity and further improves the access controls between the applicant and the PPTC information collection point. The non-data-transmitting 2D barcode application forms are capable of capturing the information in two distinct ways: the form is filled out by the applicant and information is typed in each field, and the barcode which is dynamically generated as a result. The applicant has complete control over the data entered. Select fields are dynamically encoded into a barcode section of the application for a quick initial scan by the PPTC staff and passport officers. This unique technology enables information integrity and transparency of the information processing from the time the critical personal information is typed in by the applicant to the time that Passport Officer is scanning the barcode and the data is captured electronically at PPTC.

Risk Analysis Segment

The following is a summary of the risks and mitigation strategies identified through the Assessment process.

1. Accountability

   No risks were identified.

2. Purpose

   No risks were identified.

3. Consent

   No risks were identified.

4. Collection

   No risks were identified.

5. Use, Disclosure and Retention

   This risk is identified as low.

   The applicant is responsible for protecting his/her information on the Passport Application form while he/she is in possession of the document.

   While the security measures at Passport Canada and its Receiving Agents are vigorous and substantive, there is potential risk that the applicant could expose the completed application form to situations in which a barcode reader could scan the 2D bar code on the application either accidentally or on purpose. The threat comes from portable barcode readers.

   To mitigate this risk, the applicant is informed, via the application form, that the completed application, including the 2D barcode is protected.

   Also, PPTC has posted Frequently Asked Questions (FAQS) on its external website and has further provided instructions for applicants to use in order to clear caches. As well, PPTC has trained the staff at call centres to respond to applicant’s questions.

   Further modifications to the FAQs and call centre scripts are pending.

6. Accuracy

   No risks were identified.

7. Safeguarding

   No risks were identified.

8. Openness

   No risks were identified.

9. Individual Access

   No risks were identified.

10. Compliance

    No risks were identified.