First published: 18th January 2012
A journalist from the Chinese-language Hong Kong newspaper Mingpau Daily reported using a fake thumbprint to fool the reader at the Hong Kong-China border control.
Hong Kong residents carry a "smart identity card" that stores thumbprint data. This can be used for self-service entry or exit from Hong Kong at any immigration control point. There are 391 so-called e-Channel devices distributed at the control points. To use the e-Channel, a person inserts their smart identity card into the card reader and the e-Channel gate doors will open. After entering the e-Channel, the person places their thumb flat on the centre of the fingerprint scanner, the print is recognised, matched with the ID card, and the exit opens.
In this case, the journalist reports using a fingerprint casting kit, bought on a popular Chinese auction website for HK$110, to produce the fake print. The journalist then tested five e-Channel devices at the Lo Wu and Lok Ma Chau border crossing points and found one device accepted the fake on two occasions.
The Immigration Department is following up the report and checking whether it was an isolated technical problem at just that device. The Department routinely tests the devices after maintenance and before they are put in service.
The e-Channels are used daily by thousands of people, and ease border crossings. However, this is a reminder that even well-maintained, well-tested equipment, that has been built to robust standards for high-volume usage can develop subtle faults. The reliability of the common, cheap, untested, unmaintained fingerprint readers used in many consumer-level "secure devices" must be questioned.