As Mail’s passport petition hits 310,000, evidence of foreign bidder’s security blunders emerges. So... HOW CAN FRENCH FIRM BE TRUSTED?

FRESH security fears were last night raised about the Franco-Dutch firm chosen to make Britain’s post-Brexit passports.

Gemalto, the Government’s preferred bidder, was revealed to have e supplied Estonia with as many as s 750,000 ID cards with security flaws.

Experts suggested the company could d be linked to millions of cards vulnerable e to cloning and identity theft, sold across s Europe, including to at least one government - and several private businesses.

The cards were said to contain chips s and software sourced by Gemalto from a German firm. Under the Home Office deal, l, it is thought Gemalto will also be responsible for sourcing the biometric chips for British passports.

MPs said the revelations raised further r questions about whether the company y could be trusted to deliver Britain’s new w blue travel documents.

British bidder De La Rue believes it t came out ahead of its foreign rival on both h quality and security – and was undercut t only on price. It has said it will appeal the e Government decision. Critics pointed out t that the Gemalto bid saves only £10million - a year, the equivalent of just six-anda-half - hours of UK foreign aid spending.

Last night the Daily Mail’s petition n demanding new British passports be e made in the UK surged past 300,000 signatories. A team of Mail reporters will hand it into Downing Street today, with h MPs who are backing the campaign.

Cryptography expert and CEO of Enigma a Bridge, Daniel Cvrcek – who found errors s in the Gemalto cards after testing them – said he believed millions had been issued d by the company across Europe up to September - last year, when it announced it t was ending sale of the flawed cards.

Mr Cvrcek said: ‘The cards in question n that had a problem are mostly used in the enterprise market, so large companies who use them internally to get access to buildings, computers … some of them are government, like Estonia, but the scale of cards issued was certainly millions.

‘The picture is bigger than Estonia. My guess is hundreds of large companies would have been using them.’

Mr Cvrcek said he knew of examples including a well-known financial organisation that used the cards in central Europe which had suffered a cyber-attack. The flawed cards were said to have contained chips hi and d software ft sourced df from G German firm Infineon Technologies, which said it reacted quickly to fix the error. ‘Infineon thoroughly investigated the newly developed methods and reacted immediately,” a company spokesman said at the time.

Yesterday, Estonia’s ex-president urged the UK government to approach the passport deal with caution, accusing Gemalto of ‘irresponsible’ behaviour by failing to notify Estonia about the flaws.

Tory MP Andrew Bridgen said: ‘The revelation about Estonian ID cards confirms our worst suspicions … The Government should review the contract and give the security it of f our passports t system t th the consideration it needs … As the Estonian ID card fiasco shows, the cheapest price is not always the best.’

Fellow Conservative Andrew Rosindell said: ‘The Government have dismissed the serious security concerns … the Government needs to look at this again.’

There was national panic in Estonia in November after its prime minister issued a warning over the compromised ID cards. Toomas Hendrik Ilves, Estonia’s president from 2006 to 2016, said yesterday: ‘Given Gemalto’s behaviour with Estonia, I’m not sure that the British government will be happy with its decision … I would specify in your contract with Gemalto in the strongest terms that if there are any vulnerabilities or any other problems they inform you immediately. In February last year a vulnerability was discovered on the chip that we used in our Gemalto-made ID cards.

‘We were only informed about it in August, and not by Gemalto, but by a Czech research group … That’s the definition of irresponsible behaviour.’

From 2019, Estonian ID cards will be made by Oberthur Technologies, a French firm. An Estonian official said: ‘I would guess that the Brits would have chosen a higher level [of security] for passports.’

The Mail sent a list of detailed questions to Infineon but it did not respond last night. The Home Office also did not respond to requests for comment. The department has said personalisation pages of the new blue passports, including chips, will be done in the UK.

A Gemalto spokesman said that after a ‘theoretical security threat’ was revealed in 2017, it ‘actively worked and supported the Estonian authorities to develop and implement a remedy to the said threat to the Estonian e-ID card … which completely suppressed their potential vulnerability. Such threat has never materialised, not even for a single card.’

He added that ‘all e-passports provided by Gemalto around the world are immune to this vulnerability’.

TO THOSE of us who believe that the new British passport should be printed in this country, there is a common rebuke delivered by Remainers and Brexiteers alike.

Don’t you believe in free trade? Isn’t preferring the more expensive bid of a British company to that of a European one an example of protectionism and insularity?

Surely — these critics go on — insisting that the new blue passports be manufactured even at a slightly greater cost in the United Kingdom runs counter to all the spirited talk about post-Brexit Global Britain.

I disagree. And I very much hope the Government will reconsider its choice of the Franco- Dutch company Gemalto in the light of a Mail-inspired petition with well over 300,000 signatures, being delivered to No 10 today.

Symbolism

Indeed, I am certain these doughty people speak for millions. A YouGov poll found that 49 per cent of respondents believe the blue passports should be produced by a UK company even if an overseas firm offered better prices or services. Some 29 per cent disagreed.

Will Theresa May and Home Secretary Amber Rudd listen? The answer to that question depends on the degree to which they have grasped that this, above all, is a matter of symbolism which towers above financial considerations.

As it happens, nearly all these considerations collapse under examination. I’ll come to these later. But first let me explain why I think that where the passports are printed is of such totemic importance.

More than any other document in our lives, the blue passport represents the revival of British sovereignty and independence sparked by the referendum on June 23, 2016.

Some Remainers scoff, of course. They say sovereignty and independence are illusions in an interconnected world except for huge continental powers like the United States or China. The blue passport means nothing to such people. In fact, many would rather keep their burgundy one.

But for most of those who voted Brexit, the blue passport is the very essence of what was taken away from us and has now been restored.

That is why it must be truly British. The new passport should be what it purports to be — a document signifying that the ‘bearer’ (to use the term included in the document’s preamble) is a citizen of an independent nation.

And this will categorically not be the case if a Franco-Dutch company manufactures it in its low- cost Polish plant, or even in a factory in the UK. For one thing, Gemalto is expected soon be a quarter owned by the French state.

What happens if its workers should strike, or if the firm in some other way should fail to fulfil all aspects of its contract with the British Government?

Well, the Government would be powerless in the short-term to do anything at all. The symbol of regained independence would turn out, in practice, to be subject to the vagaries of a foreign conglomerate beyond its control.

By contrast, the Britishbased company De La Rue — which makes our current EU passport, and was underbid by Gemalto for the blue one — has never missed a delivery in the decade of its current contract.

Nor has De La Rue’s loyal (and predominantly Brexit-supporting) workforce in Gateshead in the North-East, where current passports are made, lost a single day to industrial action.

Meanwhile, it transpires that Gemalto’s record of reliability is far from flawless. It is embroiled in a national security row with the Estonian government after hundreds of thousands of state ID cards made by the firm were judged vulnerable to cyber-attack. The Estonian government (and others) are reportedly considering legal action against Gemalto, which has not had its contract renewed. From 2019, the cards will be produced elsewhere. One might add that Gemalto’s commercial viability is also not beyond question. It has posted four profit warnings in 18 months. Can anyone be 100 per cent certain that the company will deliver everything it is contracted to?

The point is a simple one. A new UK passport, standing as it does for our recovered independence, should be printed in conditions over which a sovereign British Government has as much control as is possible.

Of course we can’t — and here we must grapple with the financial considerations I mentioned — ignore the matter of money. Gemalto underbid De La Rue by £120 million over an 11- year period to win the £490 million contract.

Furore

Set aside for a moment whether it can deliver at that price. Ignore possibly wellfounded insinuations that Gemalto’s bid was below cost price, and that the company is in receipt of covert loans or subsidies from the French government.

No, let us proceed as though that £120 million over ten years — £12 million a year — were real. Consider, then, the cost to the state of the mooted 200 job losses at De La Rue’s Gateshead plant.

In an area of higher-thanaverage unemployment, many of these people would be thrown on the dole. They would no longer pay income tax or National Insurance. Significantly poorer, they would buy less, and so pay less VAT. And they would be in receipt of all sorts of welfare benefits.

It’s impossible to predict what the cost would be to the Inland Revenue in lost tax, or the extra burden to the Department for Work and Pensions in new benefits, but we can be sure there would be considerable inroads into the annual ‘saving’ of £12 million.

And then, of course, there is the human side of the equation. The North-East is one of the poorest regions of the UK. Many of its inhabitants feel forgotten and forsaken by successive governments — which partly explains why such large numbers there voted Leave.

Betrayal

Are the Tories really going to betray these dutiful people when there are already so many strong arguments concerning sovereignty and independence, not to mention reasonable doubts about Gemalto’s ability to deliver? It would be a wrong-headed and careless thing to do.

Don’t forget that France, Germany, Italy and Spain all insist that their passports are produced on home soil, citing security concerns. But the British Government dumbly plays by EU rules (even though we are leaving) and gives the contract to the lowest European bidder.

When this furore blew up two weeks ago, the Government in general, and Amber Rudd in particular, looked shellshocked. The Home Secretary could not understand why her decision was deemed by so many as unpatriotic — as well as pretty bone-headed.

Seldom has the gulf between our rulers and the ruled been so dramatically illuminated. It’s one thing to hop along reluctantly to the mood music of Brexit, as Miss Rudd generally does. It’s quite another thing to understand its heart.

It’s not too late. Labour wants the blue passports to be made in this country to protect jobs. Tory free-traders can surely be induced to accept that giving the contract to De La Rue is not an affront to the idea of global trade.

The Government must grasp that this is an issue about sovereignty and independence and looking after our own people. In truth, it’s really about the future of Britain.