Overview Purpose of the EU-VIS The EU-VIS Mission In 2004, faced with the growing problem of visa shopping - people from countries outside Europe s Schengen borderless area shopping around different European states for a visa after being refused by another state - the EU Council approved the creation of the Visa Information System. Currently in the testing and build-up phase, the EU-VIS will go live in the middle of next year. The EU-VIS, which when fully in place will be the biggest single database in history, with between 80 and 100 million records, aims not just to prevent visa shopping and other forms of visa fraud, but also to serve as a powerful tool countering illegal immigration and in the struggle against terrorism. Applicants for a Schengen visa under the new EU-VIS regime must travel to an EU consulate and submit biometric data in the form of ten fingerprints and a photograph of their face. This information, valid for five years, is centrally stored in the system s database in Strasbourg, France, backed up by a secondary site in St. Johann, Austria. Then, when attempting to cross a border into the Schengen zone, a rapid, two-second verification check is instantly made to ensure that the person holding the visa matches his biometric data. A slightly longer identification check is done back office, which compares the fingerprints scanned at the border with the entire database, taking a still relatively painless ten minutes. Parallel to the ambitious new system, each country is to build up its own national system that can be connected to the central database. In Sweden, for example, the country s Migration Board is responsible, and its own VIS project has been up and running since the autumn of 2005. In anticipation of the launch of the EU-VIS, the Migration Board has engaged in cooperation with foreign authorities, the Cabinet Office and the National Police. Speed Identity AB, Mediavägen 11, Box 634, SE-135 26 Tyresö, Sweden, Tel +46 8 448 70 00, Fax +46 8 448 70 15, info@speed-identity.com, www.speed-identity.com
Challenges for the EU-VIS As impressive as the new system is, challenges remain. Quality of Biometric Data To maximise the benefit from the data that is collected, it is essential that the information is of the highest quality. If the data is substandard in any way, the system will be compromised. The crucial element here is that an individual has to be clearly tied to a specific document using the biometric data. Also of utmost importance is that data quality is consistent record to record, so that no windows are opened through which individuals can undermine the security of the system. What at first may seem the simplest element - taking a photograph of the individual is in actual fact the hardest part. The photo, which must maintain the highest quality and pass an ISO-197 94-5 standard, will, naturally very often be taken under varying lighting conditions; facial characteristics such as birthmarks must be distinguished with absolute certainty; and the image must be completely free of geometric distortion. This latter requirement refers to the problem that arises when a three-dimensional object is projected on a plane such as a digital sensor and becomes elliptically elongated. When this occurs with a person s head, it is unflatteringly referred to as egg-face. Furthermore, the fingerprints, which must be captured in accordance with BMS (Biometric Matching System) and the ISO-19794-4 standard, has to be ergonomically correct to obtain maximal quality. A small-handed individual for example stretching out her fingers to match the reader will not produce the same quality data as a hand that fits the reader more comfortably. A signature from the individual is not stored in the EU-VIS, but it is captured on-screen in the application process and archived. The signature must also be of such quality that it gives an accurate image, with enough information to provide support for the association of an individual with a particular document. The reason it is vital that the data be of the highest quality is that it has a dual role. It should serve both for efficient document production and transmission but also to aid in possible forensic investigations where the results must be able to confirm the identity of a person during legal proceedings. Hence photo, fingerprints and signature must not just be good enough for a policeman or border guard, but good enough to withstand court scrutiny. Capturing the Biometric Data There are also some technical deficiencies in the use of fingerprints for identification. It is a little-known fact, but it is estimated that up to five percent of all people are not able to register because they do not have readable fingerprints or even have no fingerprints at all - a not insignificant number of individuals. So in such cases, people must be identified in other ways. Biometric identification is by definition a statistical process. An error rate of between 0.5 and one percent is normal, which means that a system processing, the roughly 20 million people with visas who enter the Schengen area every year, a false rejection rate of 100,000 to 200,000! Remember that when fully developed, the system will contain information on about 80-100 million individuals. It is absolutely necessary that to maintain faith in the system, such errors be kept as low as possible.
Organisation Issues There is an irony to the new system: The aim of the EU-VIS is to simplify and improve the visa activities within the Schengen area, but the same time, it will increase the workload of the participating countries embassies because visa processing will no longer be able to be performed by travel agencies as is the case today. Taking a mid-sized European country as an example, last year the Swedish embassy in Moscow issued almost 36,000 visas. According to the Migration Board, 20 percent of those applying for visas, visited the Swedish embassy, while the other 80 percent were handled by authorised travel agencies. Under the new system this 80 percent will now have to visit the embassy to provide biometric information and then subsequently to receive the finished document. Worsening the situation, the Migration Board estimates that the number of visa applications submitted at Swedish embassies and consulates is growing by around 20,000 annually. But Sweden s EU-VIS workload problems are a drop in the bucket compared to larger member states such as Germany, whose consulate in Russia has to deal with several hundred thousand visa applications every year. Last year just over 214,000 applications were processed by Sweden. Nearly half of the applications were submitted in Moscow, St. Petersburg, Beijing, Bangkok and Kiev. Employees will not only take the fingerprints and photographs of applicants, but they must also perform searches in the EU-VIS. Moreover, local staff at the diplomatic and consular posts will no longer be able to process visa applications as fast as they once could because the EU-VIS system will only be able to be accessed by a limited number of authorised users. Adding to staffing issues, the person applying for a visa has to return to the embassy after a few days to collect the visa, while for an application at the border, the applicant has to wait until he is either accepted or refused. For all this work to progress smoothly, it is key that a good reservation system to facilitate scheduling appointments be implemented. Each member country is responsible for covering the not inconsiderable cost of their own national interface to the EU-VIS database, which involves the development of new systems or at least the upgrading of existing systems to communicate with the central database, as well as setting up the connections to consulates and border control points around the world. Finally, staff must also be trained in the use of the new system. As a result of this additional burden, there will be many countries that outsource their visa processing, with a private company performing the service. Sweden for example is considering outsourcing in Bangkok, Tehran and Moscow. If access to the EU-VIS is interrupted visas cannot be issued, adding yet more pressure on national authorities to get it right. This means, for example, in a power blackout, no visas can be issued. The EU-VIS is thus to a large extent reliant on the general infrastructure of each country in which application for visas are lodged.
How it works Again using Sweden as the example, first a person applies for a visa at one of the country s embassies around the world. The person has to fill out an application form and have their fingerprints captured on all ten fingers and a digital picture taken of their face. This data is then sent to the central EU-VIS database for storage. Here, serving the system s prime purpose, the fingerprints can be used to verify that the person has not already applied for a visa to another Schengen country. When the person arrives at a Schengen area border, their fingerprints are taken a second time. These fingerprints are sent to the central database to verify the authenticity of the visa and that the same person that originally applied is using the visa. If a person without documentation seeks asylum, fingerprints can be used to find out the identity of the person and in which Schengen country he or she entered first if the individual entered Schengen with the correct identity and a valid visa. The EU-VIS database will also be used by law enforcement authorities to prevent, detect and investigate terrorist crimes and other serious illegal acts. An application is always checked against both the EU-VIS and the Schengen Information System II, which maintains a list of missing persons, individuals that are requested for extradition, those requested by legal authorities such as witnesses, and suspects involved in serious offences. Reinforcing the capacity for tracking, each country can also check against a national database as. SIS II also includes fingerprints and is linked to Eurodac, the European fingerprint database for identifying asylum seekers and irregular border-crossers, and Interpol. Usage Normal Usage The Visa Codex, the set of rules governing visa distribution that references all the different language versions of the same application form and sets criteria for refusing visa applications, came into force 5 April 2010. For anyone who applies for a visa to Sweden and the Schengen area, the EU-VIS will mean new routines. Since the vast majority of applicants will be required to have their fingerprints and photographs taken, they will have to make a visit in person. The fingerprints are then stored for five years, with no new fingerprints having to be submitted if a new visa is applied for during that period. However, the photograph is only valid for six months, but for a new visa application, it is sufficient to send in a new photo to be scanned. Once the central EU-VIS database has been in operation for two years, border police at the external Schengen border will begin to verify the number of a visa sticker by making a comparison against the central EU-VIS database on all people over 12 years of age. Then, after three years, it will be mandatory to check all travellers fingerprints against the central EU-VIS database. After an application has been lodged at a Swedish embassy, the information is sent to the Migration Board headquarters and the applicant can then later return to the embassy to receive the Migration Board s decision. As a basic rule, 15 days has been defined as a maximum waiting time for receiving the decision. Applications cannot be made earlier than three months in advance of planned departure. It is not required that the visa be picked up at the same place where the application was made. From 5 April 2010, the applicant can then appeal the rejection. This process is governed by national law.
The Coast Guard and Customs Service The coast guards and customs services of countries will also have access to the EU-VIS. The coast guard will need access to the EU-VIS for both work at external Schengen borders and for law enforcement, while the customs service requires access only for law enforcement reasons. One unique problem arising in this area is that while a sailor s visa must be checked in Sweden, Norway has no such national requirement. Emergency Visas One drawback of the new system is the difficulty it introduces for the issuance of emergency visas. This is because each visa application must be decided upon before access is granted, so an applicant must wait at the border, a wait that could be several days before an answer is given. Description of Speed Solutions for the EU-VIS Responding to these challenges, Speed Identity, which already has the experience of delivering EU-VIS compatible systems to Sweden, Lithuania and Luxembourg, provides a solution for the EU-VIS integration. The Speed Capture Product range, which includes Speed Capture Station, Speed Capture Mobile and Speed Capture Light, is designed for biometric enrollment in a public environment. All peripherals, such as camera and fingerprint readers, are integrated in the casing of the Speed Capture system. In addition, the Speed Capture Products are not only suitable for visas, but also for capturing information for e-passports, driving licences and national ID cards, all domains facing similarly robust requirements and their accompanying challenges both at the EU and national levels. Biometric Matching System The Speed Capture Product range involves a Biometric Matching System (BMS) that is used to check that the fingerprints and facial image that are sent to the EU-VIS, are of sufficient quality to be accepted. The Kit 4 package comes in several versions. N.B. In a previous edition, the threshold for approval in the system was higher than currently, as earlier requirements resulted in the application process taking an unreasonably long time. As a result, the threshold has been lowered in the latest version. In the solution that Speed Identity delivered to the Swedish Migration Board, the BMS was used locally with a higher threshold value than exists for the EU-VIS, while still assuring that high-quality data is delivered and that approval into the EU-VIS database is guaranteed. Speed Capture Software The units are controlled via an application programming interface (API) over an Ethernet network connection. All units have the same API for easy integration to the authorities system, with the API accessed through a web services interface. The API has functionality to deliver quality controlled and standardised images under ISO standard 19794 and delivers quality parameters of the images to the authorities systems to aid the officer in ensuring high data-capture quality. The software can also be updated remotely through the API. Statistics for the units can be logged in a database. The system can for example log the number of enrolments, image capture time, fingerprint capture time, and so on. The software also has a self-service mode so that if the authority s system breaks down, the applicant can still enter his application. The self-service process is however monitored and supervised by an officer in the same way as the ordinary process. WILMA the Migration Board s Software In the Swedish example, the Migration Board s own software application, WILMA, is connected to the Speed Capture Software. WILMA is a web-based tool that provides the administrator with biographical and biometric data. The data is then used to produce documents such as passports or visas that allow entry to the country.
Products The Speed Capture system is ideal for a public environment. All peripherals, including the camera and fingerprint reader are integrated in the casing of the Speed Capture system. This is to create a stable photo environment with low service costs. Some of the units are adjustable for height and the open design allows an official to supervise the data capture to avoid manipulation by the applicant or other persons. The system can collect data from the entirety of a population, from children to the elderly, and is also accessible for citizens with special needs such as limited mobility or the use of a wheelchair. With the adjustable height of Speed Capture Light and Speed Capture Station, Speed Identity s solution produces the optimal working position when capturing photo, signature and fingerprint data. Particularly in the case of fingerprints this has proven crucial for high-quality data capture, while for photographs it is a must for speed and standard compliance. Signatures can be captured in a natural writing position, giving the applicant the ease to generate a more accurate signature. This is important both for the applicant as well as for forensic institutions that might use the signature as a reference years later. Business Support Monitoring System Speed Identity has, together with Sweden s Migration Board, developed a monitoring system to control Speed Identity products and applications. Every day, new logs are sent via an FTP server to Speed Identity. In order to keep track of how well each photo station is performing, two new statistical measures have been introduced. The first, availability describes how many errors are arising that affect the administrator s work in terms of operating time. The second measure tracks the error rate against the machine s time of use. Speed Identity continuously analyses these logs, and performs preventive measures based on the information. e applicant as well as for forensic institutions that might use the signature as a reference years later. Help-desk and Support The Speed Identity biometric machines are sent out long before installation and are carried into place by Speed Identity s carriers, with vital fragile parts sent separately in special packaging. Next, a technician arrives to perform the installation. Speed Identity verifies that all components work after installation, also against the client s computer. A short training period of approximately one hour takes place on the installed machine. This also makes handling, debugging and some component replacement easier. When a problem arises, the Migrations Board contacts Speed Identity via the board s dedicated support line. If they cannot solve the problem themselves, Speed Identity s service department with the support of the development department and the Government Offices IT department (RK IT) seek a solution through guidance and troubleshooting. The Migration Board s help-desk email any errors to Speed Identity. The errors are logged with Speed Identity s service system. A technician calls the end user and tries to remedy by telephone. Then the status is updated in the service system and against the Migration Board via a status mail every morning. Moving to the next level, if new hardware is needed, Speed Identity sends small parts that can be replaced easily by the staff, but when the problem requires major efforts, a technician is sent out to the station as rapidly as possible. In Sweden s major cities, a technician can be on site within four hours and in smaller towns the next business day. If problems arise in foreign countries, the technician will be on a plane within two business days. The Speed Identity Group also provides service and maintenance, provisions that are divided between our own staff and our external service partner. Included in the service arrangement is a visit to each station three times a year for preventive maintenance. Speed Identity provides installation, training, education, service, trouble shooting and support.