The Security of IDs Volume 1: ICAO Standard Travel Documents

IDs are now more standardized than ever. What elements are the same in all travel documents? And how do they relate to document security? Find out from this article.

Have you ever wondered about the odd set of codes at the bottom of your passport? Have you noticed that the travel document of a foreign friend or acquaintance has a strong resemblance to yours? This isn’t a coincidence at all. In fact, it is due to an international standard on travel documents introduced for the convenience of travelers and security officials alike.

In this article, which is a part of a series about the security of travel documents, we’ll tell you more about how this standardization came to be and how a modern ID is constructed. Aside from some trivia, we’ll also discuss how this process, seemingly ideal for ID forgers, turned into one of the pillars of creating safer documents.

A Travel Standard for the Benefit of All
Before World War I, no passport was needed for international travel. And up until the 1920 Paris Conference on Passports & Customs Formalities and Through Tickets, there were zero standards regarding the looks and contents of travel documents such as passports. 60 years passed before ICAO, the International Civil Aviation Organization, first stipulated a set of rules applied to this day on all ID documents that could be accepted at border crossing points and air/ship travel terminals.

A British passport before ICAO’s standardization came to be. Note that a second language (French) was used even back then.

No matter where you live in the world, all types of passports and IDs issued by your state comply with the standards set in ICAO Document 9303 about machine-readable travel documents or MRTDs.

Today, Doc 9303 defines three standardized travel ID documents—called TD or ID —based on their size:

• ID-1: the majority of payment cards like credit cards and ID cards. This format specifies a size of 85.60 x 53.98 millimeters (3.37 in × 2.12 in) and rounded corners with a radius of 2.88–3.48 mm (~0.12 in)
• ID-2: visas and Romanian ID cards. The standard size for these documents is a size of 105 x 74 millimeters (4.13 in × 2.91 in)
• ID-3: passport booklets. The size should always be 125 x 88 millimeters (4.92 in × 3.46 in).

Additionally, all documents falling under the specifications of ICAO Doc 9303 must also:

• be bendable while keeping the integrity of the document
• contain no toxic materials
• resist everyday chemicals
• provide machine readability between –10°C and +50°C (14°F and 122°F)
• withstand (extreme) humidity
• not become less and less legible under different lights.

Size, however, is just one part of the equation that makes traveler identification a much simpler process for travelers and security agents alike. The real key is what regular passports and other ID documents contain that comply with machine readability.

Examples of different-sized travel documents and their standard appearances. Top: ID-1 document (Hungarian identity card) Middle: ID-2 document (Romanian ID card) Bottom: ID-3 documents (Dutch and Norwegian passports)

VIZ and MRZ: At the Heart of Travel Documents
Due to the aforementioned standardization, relevant departments of state must ensure that all elements within ID-1, -2, and -3 travel documents look just as stipulated in ICAO Document 9303. This includes the most important parts of all IDs, the VIZ and the MRZ.

In the following lines, we’ll tell you more about these parts, what they constitute of, and how they are regulated, as well as some trivia that you may have never heard of.

VIZ – Visual Inspection Zone
The VIZ is the most easily identifiable part of any ID document, and it’s crucial for human inspectors to identify counterfeits. When it came to standardization, ICAO officials had to consider making each country’s relevant ID documents resemble each other as much as possible. This resulted in strict rules regarding common elements such as typeface, type size, the location of fields, personal data, the document holder’s portrait, etc. However, ICAO also had to ensure that certain things specific to the country in question were also respected.

As such, countries have the right to use their own native language on the VIZ, provided that each field’s caption is also translated to English, French, or Spanish and is separated by the oblique character “/.” In the case of English, French, or Spanish IDs, the document shall use the issuing country’s language plus another one of these languages. For example, passports of the United Kingdom have fields written in English and French.

What about countries having special Latin characters or using non-Latin alphabets? If the language has country/region-specific Latin characters, they can be included in the ID. Non-Latin characters cannot, so they must be transcribed. This rule applies to all field captions, the holder’s name, citizenship, place of birth—which is optional—and the issuing organization.

Date-wise, there are more restrictions. Not only do they have to be printed in the day-month-year format, but the day (two digits) and the year (two or four digits) must be in Arabic numerals. Optionally, the month can be written either as a two-digit number or displayed in the national language in its full or in a shortened format, provided that the latter isn’t more than four digits.

If the month is written, the same translation and -literation rules apply as for field captions. Separating the day, month, and year by a blank space, a dot or an oblique character is only needed if the month is represented in numerical format.

This Slovakian specimen ID card clearly shows all requirements for a travel document’s VIZ area.

MRZ – Machine Readable Zone
While there are certain liberties in the VIZ of ID documents, the MRZ has a virtually identical appearance in all travel documents. The reason for that is simple: this particular zone in travel documents is what all passport readers and ID scanners must be able to process and verify, so MRZ’s standardization is a must.

As such, everything from typeface and type size to the actual dimensions of the effective reading zone (ERZ)—which should always be 17 mm × 118 mm (0.67 in × 4.65 in)—is strictly regulated by ICAO’s Doc 9303.

This standardization is also the reason why only Arabic numbers and no characters aside from the 26 letters used in the English alphabet are used. The only special character permitted for the MRZ is “<.”

It’s used to clearly separate fields like the document’s type, number, the issuing state’s three-letter code, dates in YYMMDD format, the holder’s first and last name, and various checking digits, the calculation of which is stipulated in Appendix A Part 3 of Doc 9303. To get an idea of how MRZ is created, check out this online tool where you can try generating your own MRZ.

When it comes to names, all of them must also be written in their Latin counterparts using the 26 letters from the English alphabet regardless of whether the user is from a country using Latin characters or not.

For example, German “Ä” will appear as either “A” or “AE,” Cyrillic “Ш” will become “SH”—or simply “S” in Serbia—and the Arabic “ى” character (alef maksura) should be written in the MRZ as “XAY.” Speaking of Arabic characters, they got an entire appendix in Part 3 of ICAO’s Document 9303 due to the complexity of founding the Latin counterparts of Arabic characters.

An example of how Arabic names should appear in a travel ID. Source: Appendix B to Part 3: Specifications Common to all MRTDs of Doc 9303 Machine Readable Travel Documents.

The Importance of Standardization From Security’s Point of View
The standardization of ID document sizes and content was important for strengthening verification processes. In fact, the addition of MRZs to travel documents opened the gates for the rapid development of document scanners such as the ones manufactured by Adaptive Recognition.

When a travel document needs to be verified, security officials can check its validity via its physical attributes and gather all necessary information about its holder with a single peek. When advanced passport readers are involved, MRZ and VIZ data are compared to each other within seconds, immediately spotting any differences between the two.

It’s worth noting, however, that nowadays, having just the MRZ and VIZ on a travel document is far from enough. In fact, as Tony Sales, a former passport forger told CNN back in 2014, it took him mere hours to create eerily convincing forgeries from stolen passports for thousands of dollars. Still, there are times when the document doesn’t need to be changed at all; as long as the imposter resembles an ID’s original owner, they could slip by security.

For this reason, even ICAO recommends that issuing countries/manufacturers incorporate at least basic security features/measures that could turn a travel document forge-resistant—with the only condition being that those features don’t interfere with the machine readability of the ID. However, due to a lack of standards concerning security elements, each state and ID manufacturer has the liberty to decide what they include in the travel document. Even the EU provides nothing more than a minimum requirement for each member state, including many elements that are “only” recommended.

Some of the most common—and the best—security features: First row: multicolor UV ink, microfibers. Second row: various hologram patterns, JURA security features IPI™ and LetterScreen++®.

What’s for sure is that if the travel document contains a random combination of

• multi-colored UV inks,
• micro prints and -fibers placed randomly all over the document or forming a unique pattern/words/sentences,
• Letterscreen++® by JURA, which is a patented process where the portrait of the passport’s owner is built up from a personalized micro text arranged in a unique wavy lines-structure,
• IPI™, or Invisible Personal Information, that contains personal data in the primary portrait and can only be read using a special lenticular lens,
• more traditional techniques such as special perforations, holograms, etc.,

then chances that the document can be forged drops significantly. And as a necessary consequence of 9/11, new passports are issued with an additional security element, RFID chips, containing everything found in the VIZ and MRZ and other additional data. As for what data could be stored on an RFID chip, it will be the topic of our next article in this series.

Basically, what happened is that document size, VIZ, and MRZ all became part of the big picture that is creating virtually unforgeable IDs. And even if alteration is made to the VIZ and/or MRZ, advanced security features and high-tech ID scanners like Adaptive Recognition’s Osmond can easily alert security officials.