1. An ePassport contains an electronic chip containing biographical information and a digital facial image of the passport holder. The chip can be read using an appropriate electronic reader located at border control or within Identity and Passport Service offices. The ePassport was the first official UK document to incorporate an electronic chip in a paper document and it incorporates technically advanced security features to make it harder to forge and prevent unauthorised reading of the chip. The US required countries wishing to continue their participation in the US Visa Waiver Scheme to introduce ePassports by 26 October 2006. The Identity and Passport Service achieved 100% production of ePassports in September 2006, thereby securing the UK's continued participation in the Visa Waiver Program. The project was delivered within its budget of £62 million. Second generation ePassports, which will be issued from 2009, will store the holder's fingerprints on the chip in addition to the digital photograph.

2. The agency's experience of introducing ePassports has been a useful step towards the incorporation of personal data on to an electronic chip. The Identity and Passport Service acknowledged that it still has some way to go to master the technology needed to put fingerprints on a chip, and that there are issues to resolve with chip capacity for the national identity card project. It was confident, however, that it could deliver second generation ePassports and the national identity scheme to time and budget.

3. The Identity and Passport Service implemented to good effect the recommendations made by our predecessors in respect of its forebears' less successful projects (Figure 1). The agency planned from the outset for a cautious, low risk project. The prototype ePassport and the manufacturing process were both subject to substantial testing, and the agency gave itself enough time for a progressive rollout rather than a big bang switch immediately from digital to ePassport. It also put in place an effective communication plan to educate the public about ePassports. With the significant expansion in operations planned to accommodate Authentication by Interview, and the introduction of second generation ePassports, the agency needs to be sure it has the capacity and skills to handle these more complex projects.[2]

Figure 1: Previous Public Accounts Committee recommendations incorporated into the ePassports project

PAC Report and conclusions	Experience on ePassports
The Passport Delays of Summer 1999[3]
(iii) "Testing and initial implementation raised questions… which were not adequately resolved… We [also] emphasise the importance of sound risk management arrangements."	Testing was based on an end-to-end approach whereby major processes and production equipment were subject to a rigorous test and evaluation regime. The management of risk on the project was sound with risk coordinators appointed in 2004. Risk registers, including those held with contractors, and risk management plans were revised periodically.
(vi) "The Home Office's forecast of 5.1 million passport applications in 1999 was well short of the 5.6 million actually received… The Home Office is expected to act on their commitment to improve their forecasting."	Between 1 January 2006 and 6 August 2006, the Identity and Passport Service's forecast of five million passport applicants was above the 4.6 million actually received.
(vii) "The Agency's contingency planning proved wholly inadequate… We emphasise the need for adequate contingency plans in key public services."	Risk management has been tight while contingency planning in the event of a disaster at the main production site has been met by the building of the Reserve Facility, which is the most cost-effective solution to this issue.
Criminal Records Bureau: delivering safer recruitment?[4]
(i) "Timetables for the development and implementation of new services should provide for sufficient in-depth consultation directly with potential users of the service, and for the outcome of consultation to be reflected in service design".	Because of a tight project timescale and evolving technical standards, it was difficult to establish a definitive requirement. End users were consulted on the planned use of public readers but not on any other aspects of the project.
(iii) "Adequate time for piloting new services is fundamental to successful introduction".	Central production was piloted and actual production gradually built up by Security Printing and Systems Limited. The ability to revert to digital production was retained in case of failure. The initial pilot for ePassports was carried out at the Durham regional office in December 2005. It was then piloted at the other offices on an iterative basis in the first half of 2006 in advance of the roll-out at each office.
(v) "If business assumptions change fundamentally during service development, Departments should consider whether to continue with their current contractor or test the market again".	The Identity and Passport Service decided to amend the contract with Security Printing and Systems Limited, because changes to the project timetable occurred too late for the Service to reconsider its procurement strategy
Consular services to British nationals[5]
(ix) "Issuing passports at over 100 posts is inefficient… The Department should analyse the costs and benefits of repatriating large elements of passport work to take advantage of the economies of scale and quality assurance arrangements of the [Identity and] Passport Service."	The Foreign and Commonwealth Office is reviewing its overseas passports issuing operation. By 2010 it is expected that passport production will have been significantly rationalised either to three overseas 'super-hubs' or to a central production site alongside the Identity and Passport Service in the UK

Source: National Audit Office

4. The Identity and Passport Service has collated lessons from all of its 2006 projects (Figure 2) based on both what the Service did well and what it wished it had done and, for the benefit of others delivering similar projects, it has made the details available on its website. [6]

5. Given that chip-based technology is central to second generation ePassports and identity cards the agency acknowledged the reasonable concern that the ePassport chip may not be durable enough to last the full ten year lifespan of the ePassport. The Identity and Passport Service was under pressure to introduce the ePassport quickly in order to meet the US deadline and, given the newness of the technology, had to accept a guarantee from the chip manufacturer of just two years. However, the ePassport chip has been tested extensively and the Identity and Passport Service was confident that the chip would work for longer. It planned to secure longer warranties from suppliers in the future, provided the cost of so doing was reasonable. The ePassport is still a valid travel document[7] should the chip fail when the passport holder is overseas.

6. The Identity and Passport Service stated that anyone trying to access the electronic data on the chip would also need the data from the printed biographical page to do so. As the printed data replicates the data on the chip, reading the chip would give no advantage. Any tampering with an ePassport would be evident via physical or full electronic checks. Passport holders concerned about the integrity of the ePassport chip data can view their passport chip using public readers situated at Passport Offices.[8]

Figure 2: Lessons and best practice identified by the Identity and Passport Service from completed projects

Project scope should be clearly defined and agreed by all parties at project initiation. Project priorities should be managed through a programme level plan which identifies potential conflicts in resources and implementation schedules. Regular meetings should be held with external stakeholders and senior Identity and Passport Service staff to encourage collaborative working, the sharing of resources between stakeholders and to allow the impact of proposed solutions to be assessed and planned for accordingly. Appoint dedicated Operational change Manager(s) to manage the transition between the project team and the rest of the business, and to manage change within Identity and Passport Service regional offices. Agree realistic contingency plans with business owners in advance to ensure a minimal impact on operations should it become necessary to implement them.

Manage all changes to project scope and business requirements through a change control process. Contract changes should be discussed with relevant stakeholders before their acceptance. The process should include an impact assessment of changes to scheduled events where appropriate. 'Contract Summaries' should be used to communicate changes for non-commercial staff. Ensure Identity and Passport Service and suppliers' responsibilities are clear in contracts and well understood. This includes test and quality assurance criteria, subcontract management and product acceptance processes. Project staff should retain responsibility for managing communication between identity and Passport Service and suppliers. Where multiple stakeholders exist their requirements should be managed through a single point of control.

Source: 'ePassport project status update and lessons learned report', Identity and Passport Service

7. The Identity and Passport Service is to be commended for its smooth delivery of the ePassports project which was achieved with little disruption to the quality of service to the public. The agency is rightly keen to repeat this success with its other high profile projects, including the move to second generation ePassports and the introduction of the national identity card scheme. Second generation ePassports and identity cards pose greater technical and logistical challenges than first generation ePassports, however, and risks remain on durability of first generation ePassport chips and the potential build-up of queues at border control arising from the longer time taken to read an ePassport.[9]

3   Committee of Public Accounts, Twenty-fourth Report of Session 1999-2000, The Passport Delays of Summer 1999, HC 208 Back

4   Committee of Public Accounts, Forty-fifth Report of Session 2003-4, Criminal Records Bureau: delivering safer recruitment? HC 453 Back

5   Committee of Public Accounts, Thirty-ninth Report of Session 2005-06, Consular services to British nationals, HC 813 Back

6   Q 11 Back

7   Qq 60-63, 65, 136, 137, 160-163 Back

8   Qq 33, 69, 70-72, 74-76 Back

9   Qq 3, 139-141 Back