Flaw found in blue passport firm’s ID cards

THE Franco-dutch firm set to produce British passports is embroiled in a national security row with the Estonian government after hundreds of thousands of state ID cards were found to be vulnerable to cyber hackers and were suspended, The Daily Telegraph can disclose.

Gemalto, the preferred bidder to produce the new blue passport, has been accused of failing to notify the Estonian government of a flaw that made its electronic ID cards vulnerable to cloning and identity theft. As many as 750,000 ID cards produced by the company since 2014 were found to be compromised, sparking a national panic in November.

The disclosure comes amid a growing backlash over the Government’s decision to award a £490million contract to the firm.

While France and Germany have refused to outsource passport procurement under security exemptions, UK ministers have insisted there are no security or operational risks associated with the deal. However, following the most recent revelations, Sir Bill Cash, the veteran MP, said he had “serious concerns” about the level of due diligence carried out during the tendering process.

“In light of the Estonia debacle, it just doesn’t seem to me that sufficient inquiries have been made into the nature and quality of the contracting party,” he said. “This is an example of a failure of due diligence and, at the very least, a reason for us not to take on this contract.”

Meanwhile, De La Rue, which produces the current UK burgundy passport, confirmed it was preparing to take the Home Office to judicial review after its bid was undercut.

The Telegraph understands De La Rue is seeking assurances that Gemalto, part-owned by the French government, is not in receipt of any state-backed loan or subsidy which would have enabled it to unfairly undercut its competitors, forbidden under European law.

Estonian officials told The Telegraph that their government is considering legal action against Gemalto, which has not had its contract renewed.

From 2019, Estonian ID cards will be produced by Oberthur Technologies, a rival French firm, after a legal challenge by Gemalto was dismissed in the courts. The security flaw, discovered last August, forced the Estonian prime minister to issue a public warning.

The cards, used by Estonians to file taxes, manage healthcare and vote electronically, were subsequently suspended. Gemalto was unavailable when contacted for a comment. Richard Tice, Business page 2