It seems that international spy rings are borrowing the luck of the Irish, and the Irish don’t like it one bit.
Irish passports have become the document du jour for international spies and assassins, a trend that highlights the immense challenges facing those who wish to keep U.S. borders safe.
In 2005, Eunan Doherty, a fireman from the remote northwest Ireland county of Donegal, went to the Russian Embassy in Dublin to get a visa for a vacation trip to Russia. His holiday allegedly turned him into an unwitting participant in a now-famous international Russian spy ring.
Four years later, a Russian agent using the name Richard Murphy flew to Rome to pick up a forged passport bearing Doherty’s name, and was told to bring it into the U.S. and give it to another Russian spy, according to an affidavit made public by the U.S. government in June. Murphy was told to identify the courier by uttering the line, “Excuse me, could we have met in Malta in 1999?” the affidavit said.
Irish news organizations reported that Doherty’s wife’s identity was also used by the spy ring, too.
Likewise, Catherine Sherry, a volunteer with the Irish orphan-aid organization To Russia With Love, had her identity used by the same spy ring, and a forged passport created in her name.
The spy ring unraveled in June, when American investigators exposed it with great fanfare, and 10 alleged Russian secret agents were expelled — among them, the now infamous Anna Chapman, who began her career as pin-up model this month as the cover girl on Maxim magazine’s Russia edition. During the investigation that followed, officials determined that forged Irish documents played a key role in the conspiracy.
This month, Irish authorities said as many as six Irish nationals had their identities stolen and used by the ring, an incident which had Irish commentators crying foul. But it’s not the only recent incident in which Irish passports were used by agents of international intrigue.
When senior Hamas official Mahmoud al-Mabhouh was assassinated in a Dubai hotel room in January by a hit squad, eight of the suspects held Irish passports. The investigation of that incident is ongoing, but an Israeli diplomat was expelled from Ireland in June as part of what the Irish government called a “protest action.”
As a traditionally neutral and friendly nation, Irish passports are seen as desirable for would-be secret agents, as they can enable freer movement across borders, and the friendly relationship between Ireland and the United State typically invites few questions at crossings.
But Irish citizens are complaining that their neutrality and generally good name are being borrowed by foreign agents. You’ve heard of medical identity theft, or criminal identity theft? Call this national identity theft.
The passport scandal was called a “humiliation,” by Irish Independent columnist Michael Brennan, who said that the incidents have “badly damaged” the Irish reputation for being friendly and neutral. Ironically, news of the six Russian forgeries hit just as Russia’s national soccer team defeated Ireland 3-2 in a critical Euro 2012 match in Dublin, adding insult to injury.
“They are not only taking the points we need to qualify for the European Championships, but they may very well be taking our passports, too,” Brennan wrote.
Putting everyone at risk
But the passport forgery is hardly a laughing matter, said U.S.-based security expert Mark Rasch.
“They are putting everybody who is Irish at risk and under suspicion,” said Rasch, former head of the computer crime unit at the U.S. Department of Justice and now director of cybersecurity and privacy at computer security firm CSC in Virginia. “People at the border will think, ‘Maybe they are a spy,’ The Irish are right to be concerned.”
Irish passports are a target for a few simple reasons. Spies who want to be mistaken as members of English-speaking societies will generally avoid being identified as U.S. or U.K. nationals, which can raise suspicions, preferring identities connected to Ireland, Canada, Australia, or New Zealand, Rasch said. In fact, four of the Russian spy ring members claimed to be Canadian, including one who assumed the identity of a baby who died shortly after birth decades ago near Montreal, according to CTV Toronto.
But Irish passports offer the added benefit of allowing free movement within the European Union.
Passport forgery is not a new problem, and the U.S. government has taken steps to make life harder for imposters. In 2006, the U.S. government radically changed the nature of international travel by requiring that each new U.S. passport include a radio frequency identification (RFID) chip and creating biometric requirements for visitors to the U.S. Chip-enabled passports are theoretically harder to forge, as they can contain an image of the rightful passport holder and other biometric information, such as a fingerprint scan. Many other developed nations followed suit and began adding chips to their passports, but there are still millions of valid passports that predate the technology. That means border officials are obliged to accept older, paper passports. Investigators believe the Irish fakes were the old-fashioned kind.
‘We are all connected now’
The incidents highlight the difficulty facing immigration officials who want to balance efforts to identify travelers with keeping borders open for tourism. U.S. border officials are forced to trust passport-issuing authorities at nations around the world — both their ability to positively identify individuals before they issue passports and their ability to produce documents that can’t be easily forged.
“We are all connected now,” Rasch said. “The only way we can trust a passport is if we trust the issuing agency. This is the idea of cascading trust. For example, if I can hack computers that make French passports, Chilean passports or, Swiss passports, I can for all intents and purposes take that system over and get them to issue what will be a valid French, Chilean or Swiss passport. And we trust these documents issued by foreign agencies.”
The risks are real, said Rasch. As a federal prosecutor, he helped investigate a crime where a passport official was bribed by criminals and persuaded to issue fraudulent U.S. passports.
“But let’s take it a step further,” he said. “Say the French accept a birth certificate for issuing a passport. I just have to hack a local agency in France to get a birth certificate, apply for a passport with it and their computerized records will indicate (the document is ) valid and will cause them to issue a passport.”
Since the mandatory RFID requirement was put in place, the U.S. State Department has issued more than 50 million passports. By 2016, old-fashioned chipless U.S. documents should be out of circulation. Still, chips have exploitable flaws, and security experts continue to demonstrate the technology’s fragility. While the biometric information on chips does make it harder to alter information on the passport, they do little to prevent someone from obtaining a new passport using fraudulent so called “breeder” documents, like birth certificates — an issue sometimes referred to as the “initial authentication” problem.
Other flaws dog the international passport system, Rasch warned. Not every border guard at every crossing has full access to databases that instantly reveal biometric information stored on passports, he said, rendering that part of the system ineffective. Many countries have yet to sign up for the public encryption key system designed to authenticate the passport issuing agency and prevent fakes. And the U.S. will continue to be forced to honor other nations’ chipless passports for a long time. Canada, for example, won’t start requiring RFID passports until next year.
It means that for the foreseeable future, a traveler presenting an Irish passport may well be a Russian spy or a potential assassin – and keeping the country safe will require a little bit of Irish luck, in addition to the state-of-the-art technology.
