AdemolaOladele,ROAVSEC/FALICAOWACAFRegionalOffice,Dakar,Senegal
IMPLEMENTINGBIOMETRICSANDADVANCEDPASSENGERINFORMATION(API)
ICAOTRIP:BuildingTrustinTravelDocumentSecurity
ThreeinterrelatedpillarsofFacilitation
Annex9 ICAOTRIPStrategy ICAOPKD64Annex9SARPsarerelatedtotheTRIP
2
Objective:AllMemberStatescanuniquelyidentifyindividuals
Annex9-FacilitationImplementationoftheAnnex9StandardsandRecommendedPratices(SARPs)areessential:• Tofacilitatetheclearanceof
ü aircraftü passengersandtheirbaggageü cargoandmail,and
• TomanagechallengesinbordercontrolsandairportprocessessoastomaintainboththeSecurityandtheefficiencyofairtransportoperations• Integratesfunctionofagenciesrelatedtobordercontrol:
Traveldocuments,immigration,customs,quarantine,lawenforcement,transportoperators
• Requiresinter-agencyandcross-bordercooperationtoimplementAnnex9obligations 3
Biometrics
NodefinitioninAnnex9eMRTD-AnMRTD(passport,visaorcard)thathasacontactless
integratedcircuitembeddedinitandthecapabilityofbeingusedforbiometricidentificationoftheMRTDholderinaccordancewiththestandardsspecifiedintherelevantPartofDoc9303—MachineReadableTravelDocuments
4
CHAPTER3.ENTRYANDDEPARTUREOFPERSONSANDTHEIRBAGGAGEI. Inspectionoftraveldocuments
3.3Standard:ContractingStatesthatuseintegratedcircuit(IC)chipsorotheroptionalmachinereadabletechnologiesfortherepresentationofpersonaldata,includingbiometricdata,intheirtraveldocumentsshallmakeprovisionwherebytheencodeddatamayberevealedtotheholderofthedocumentuponrequest
Biometrics
5
Biometrics:CHAPTER3.ENTRYANDDEPARTUREOFPERSONSANDTHEIRBAGGAGEC. Securityoftraveldocuments
3.9RecommendedPractice—ContractingStatesshouldincorporatebiometricdataintheirmachinereadabletraveldocumentsinacontactlessintegratedcircuitchip,asspecifiedinDoc9303,MachineReadableTravelDocuments
Note.—Doc9303doesnotsupporttheincorporationofbiometricdatainvisas
6
Biometrics
CHAPTER3.ENTRYANDDEPARTUREOFPERSONSANDTHEIRBAGGAGEI. Inspectionoftraveldocuments
3.34.5 RecommendedPractice—ContractingStatesutilizingABCsystemsshould,pursuantto3.9.2and3.10.1,usetheinformationavailablefromthePKDtovalidateeMRTDs,performbiometricmatchingtoestablishthatthepassengeristherightfulholderofthedocument,andqueryINTERPOL’sStolenandLostTravelDocuments(SLTD)database,aswellasotherbordercontrolrecords,todetermineeligibilityforbordercrossing 7
Doc9303-MachineReadableTravelDocumentsspecificationsPart1:Introduction
Part2:SecurityoftheDesignPart3:AllMRTDsPart4,5,6:TD3,TD1,TD2SizePart7:MachineReadableVisaPart9:DeploymentofBiometricIdentificationandElectronicStorageofDataineMRTDsPart10:LogicalDataStructureforStorageBiometricsPart11:SecurityMechanismsforMRTDsPart12:PublicKeyInfrastructureforMRTDs
8
Doc.9303,Part9/ICAOVisiononBiometrics(1)TheICAOvisionfortheapplicationofbiometricstechnologyencompasses:§ Specificationofaprimaryinteroperableformofbiometricstechnologyforuseat
bordercontrol(verification,watchlists)aswellasbycarriersanddocumentissuers,andspecificationofagreedsupplementarytechnologies
§ Specificationofthebiometricstechnologiesforusebydocumentissuers(identification,verificationandwatchlists)
§ Capabilityofdataretrievalfor10years,themaximumrecommendedvalidityforatraveldocument
§ HavingnoproprietaryelementthusensuringthatanyStatesinvestinginbiometricsareprotectedagainstchanginginfrastructureorchangingsuppliers
9
Doc.9303,Part9/ICAOVisiononBiometrics(2)Doc9303considersonlythreetypesofbiometricidentificationsystemsWithrespecttothestorageofthesethreebiometricfeaturesinthecontactlessICofaneMRTD,theissuingStateororganizationSHALLconformtotherelevantinternationalstandard
Thethreetypesofbiometrics:
§ Facialrecognition–MANDATORY.MUSTcomplytoISO/IEC§ Fingerprintrecognition–OPTIONAL.Ifused.MUSTcomplytoISO/IEC§ Irisrecognition–OPTIONAL.Ifused.MUSTcomplytoISO/IEC
10
Annex9-FacilitationTravelFacilitation
• Efficientmanagementofbordercontrolprocessestoexpediteclearance(ofaircraft,passengers/crew,baggage,cargo)
• PreventunnecessarydelayssoastomaintainboththeSecurityandtheefficiencyofairtransportoperations.
• RequirescoordinationbetweendifferentagenciesrelatedtoBorderControlManagement,e.g.traveldocuments,immigration,customs,lawenforcement,transportoperators
11
Morethan3,6Billionsinternationalpassengersarecontrolledatthebordersin2017Inthenext15yearsthisnumberwilldouble
Aminimumof10secondsareneededforthebordercontrolofeachpassengerImportantlackofresourcestoexpediteclearanceattheborders
MainFacilitationChallenge
100,000DailyFlights
12
Morethan50%ofinternationaltouristsaretravellingbyair
13
InboundInternationalTouristsbytransportmode
Leadership of ICAO in the development of Standards and specifications for Travel documents
Source:UNWTO
RoleofvisafacilitationinAirTransportgrowth
14 Source:UNWTOVisaopennessreport2018
Objective:ModernizationoftraditionalvisasandlinktheeVisatoiAPI
53%oftheworldpopulationneedavisabeforetravellingandonly10%canobtainanelectronicvisa
PasdevisaeVisa
eVisa:30ETA:5On-lineApplication:11
ElectronicVisasStatus
46States
Canada
États-Unis
Australie
RoyaumeUni
SriLanka
6States2011
ETA:ElectronicTravelAuthorization 201815
16
EvidenceofIdentity MRTDs
DocumentIssuanceand
Control
InspectionSystemsand
Tools
InteroperableApplications
The5thelementoftheICAOTRIPStrategy:AllitemsareBorderSecuritytools
• MachineReadableTravelDocuments(MRTDs)• AdvancePassengerInformation(API)• PassengerNameRecord(PNR)• INTERPOLStolenandLostTravelDocuments
(SLTD)database• ICAOPublicKeyDirectory(PKD)• Watchlists• eVisas• ‘’Trusted’’or‘’expedited’’travellers
ePassportorBiometricPassport• ePassportsareMachineReadablePassports(MRPs)withachip(IC)• ThechipisanadditionalsecurityfeatureanddoesnotreplacetheMRZ• Enhancessecurityofthedocument• Biometricstoconfirmidentity
17
ePassportstatusbyregionRegion Numberof
MemberStates NumberofMember
StatesissuingePassports AsiaandPacific(APAC) 39 21
EasternandSouthernAfricanOffice(ESAF)
24 15
EuropeanandNorthAtlantic(EUR/NAT)
56 55
MiddleEast(MID) 15 12 NorthAmerican,CentralAmerican
andCaribbean(NACC) 21 6
SouthAmerican(SAM) 13 8 WesternandCentralAfrican
(WACAF) 24 19
Total
192 136
However despite
the past deadline of 24 November
2015, there are still Non Machine
Readable Passports in circulation
18
The ICAO PKD is an inspection tool enabling to verify and authenticate
ePassports
TheePassportandtheICAOPKD
UNSCResolutions2178(2014)and2309(2016)• “Reaffirms that all States shall prevent the movement of terrorists or terrorist groups by effective border
controls and controls on issuance of identity papers and travel documents, and through measures for preventing counterfeiting, forgery or fraudulent use of identity papers and travel documents…’’
• “9. Calls upon Member States to require that airlines operating in their territories provide advance passenger information (API) to the appropriate national authorities in order to detect the departure from their territories, or attempted entry into or transit through their territories, by means of civil aircraft, of individuals designated by the Committee established pursuant to resolutions 1267 (1999) and 1989 (2011)…’’
20
• “Noting that Annex 9 —Facilitation to the Convention on International Civil Aviation, done at Chicago on December 7, 1944 (the “Chicago Convention”) contains standards and recommended practices relevant to the detection and prevention of terrorist threats involving civil aviation ‘’
• “Further calls upon all States to require that airlines operating in their territories provide advance passenger information to the appropriate national authorities in order to detect the departure from their territories, or attempted entry into or transit through their territories, by means of civil aircraft, of individuals designated by the Committee pursuant to resolutions 1267 (1999), 1989 (2011) and 2253 (2015);’’
MaximumpersonaldataElementsinAPIforMRPs
21
AllareintheMachineReadableZone(MRZ)exceptPlaceofbirthintheVisualInspectionZone(VIZ) MachineReadableZone
VIZ
PlusElementsofFlightdetails:AllinformationrequiredshallconformtospecificationsforUN/EDIFACTPAXLSTmessagesfoundintheWCO/IATA/ICAOAPIGuidelines.
22
1.WhyyourstateshouldestablishanAPIsystem?
UnitedNationsSecurityCouncilResolutions2178and2309
ICAO’snewStandard9.5(includedinAmendment26toAnnex9oftheChicagoConventionandadoptedon23October2017)
AsaContractingStatetotheChicagoConvention,observanceofICAOstandardsismandatory.
StatusofAPI/iAPIprogrammes:65MemberStatesNewAnnex9Standard:APImandatorysince23February2018
Legend
iAPIinforce(total:16)
APIinforce(total:49)
Source:IATA
UNSCResolutions2178(2014),2309(2016),2368&2396(2017)iAPI:InteractiveAPI
23
ICAOAnnex9StandardsandRecommendedPractices(SARPs)forAPI(9.7,9.9,9.10,9.11,9.12,9.13)
EstablishingAPISystems9.5 Each Contracting State shall establish an Advance Passenger Information (API) system. 9.6 The API system . . . shall be supported by appropriate legal authority . . . and be consistent with internationally recognized standards for API. Areas to be addressed in legislation (examples):
1. UN/EDIFACT Paxlst for API transmission 2. Purposes for which API required 3. Data elements required 4. “Passenger Data Single Window” 5. General legal issues 6. Operational issues addressed in Annex 9 & . . . Etc.
APIBenefits
APIdatacanprovidedifferentbenefitstobordermanagementandaviationsecurity:• Ithelpstoimprovebordercontrolandtocombatirregularimmigrationmoreeffectively.• ItfacilitatesIntegratedBorderManagementthroughtheuseofaSingleWindowfacility.• Itallowsforthereductionoftheworkloadofbordermanagementofficersthroughtheuseof
technologyandautomatedmeans.• Itimprovescitizens’perceptionofsecurityandcontributestoafasterprocessingofbonafidetravellers.• Itcancomplementexistingdatavettingprocesses,suchascheckingthepassportsofindividuals
travellinginternationallyagainstwatchlistsanddatabases(e.g.INTERPOLStolenandLostTravelDocumentsdatabase).
• AninteractiveAPIsystem(iAPI)• Enhancesaviationsecurity.• Allowsforreal-timedocumentvalidationagainstandallowsnationalauthoritiestomakeboard/no-
boarddecisionsinrealtime.• Reducescarriers’exposuretopenaltiesforundocumentedpassengersorpassengerswhoseofficial
traveldocumentsarenotvalid.
25
InitialStepsforaStatetoimplementanAPISystem
26
DeterminewhichagencieswillmakeuseofAPIdata,suchasBorderPolice,Customs,Intelligence,INTERPOLNationalCentralBureau(NCB).
EstablishaNationalAirTransportFacilitationCommittee(Annex9Std8.17)toensurecoordinationwithallactorsinvolved.
SetastronglegalbasisforrequestingAPI,definingdataelementsandallowingforinter-agencyandinternationalpolicecooperation.AnAPIsystemcannotbeintroducedwithoutaproperlegalframeworkinplace.
SettingaNationalLegalFrameworkforAPISomeelementstobeincludedintheregulatoryframework
27
ThedataelementsrequiredforAPItransmissionandprocessing.
ThetransmissiontimingofAPIdatabyairlines.
Thepurposesfordatauseandtransfer.
Thepurposeofdataretentionandthemaximumperiodfordataretentionthatissufficienttoachievetheobjectivessetoutinthelaw.
AdequateredressmechanismsforpassengersthathavebeenunjustlyaffectedbyadecisiontakenbynationalauthoritiesonthebasisoftheprocessingofAPIdata.
28
DetermineprecisecostsandbudgetfortheimplementationofanAPIsystem.
CreateaPassengerDataSingleWindow(aninter-agencytargetingbureau)tofacilitatedatasharingInstitutesystematiccheckingofAPIdataagainstbothnationalandinternationalwatchlists,suchasInterpoldatabases.
DecidehowAPIdatawillbetransmittedtothegovernment'sITsystem-willconnectivitytoairlinesystemsbedevelopedinternallybythegovernmentorbyanITserviceprovider(dependingonbudgetconstraintsandStatesITcapability)?
BuildtheBusinessCaseandtheimplementationprocess
29
ComplyingwithGlobalStandards
Annex9totheChicagoConvention–Facilitation-StandardsonAPIare9.5,9.6,9.8,9.9,9.11and9.13.-Amendment26toAnnex9wasadoptedon23October2017,makingtheestablishmentofAPIsystemsalegalobligation.ThisprovisionhasbeenapplicableforContractingStatesfrom23February2018on.ICAO/IATA/WCOGuidelinesonAPI-TheGuidelinesarereferencedbytheICAOstandardsandprovideguidancetoStatesseekingtoimplementAPIsystemsshouldadhere.-Theyaddressimportantissues,suchasthelistofdataelementsthatbordercontrolauthoritiesmayrequireinrespectofaninboundoroutboundflight.-MessageImplementationGuideprovidesthePAXLSTmessagestructureandindicateswhichdataelementsaremandatoryandwhichareconditional.
MessageStructureandTechnicalSpecifications-UsingthestandardmessagestructureUN/EDIFACTPAXLSTwillhastenimplementationanddecreasecostssignificantly.-Industrycananddoessupportsuchprogrammes.
ProtectionofPersonalData
30
Collection,storageandprocessingofpassengerdatacanhaveimplicationsonhumanrights,includingtherighttoprivacyandtheprotectionofpersonaldata.Article17oftheInternationalCovenantonCivilandPoliticalRightssaysthat“nooneshallbesubjectedtoarbitraryorunlawfulinterferencewithhisprivacy”.Therefore,eachStatehastoensurethatAPIdatais:• obtainedandprocessedfairlyandlawfully.• storedforlegitimatepurposesandnotusedinawayincompatiblewiththosepurposes.• adequate,relevantandnotexcessiveinrelationtothepurposesforwhichtheyarestored.• accurateand,wherenecessary,keptuptodate.• preservedinaformwhichpermitsidentificationofthedatasubjectsfornolongerthanis
requiredforthepurposesforwhichdataisstored.
31
IncludeStakeholdersEarly ThebestAPIimplementationprogrammesaredevelopedbycountrieswhoinvolvestakeholdersearlyintheprocess.Communicationbetweengovernmentauthoritiesandstakeholders,particularlyairlines,leadstobetterinitialstructuraldecisionsandtoabetterfinalsystemdesign.
Whyisitimportanttoengagewithairlines?
Tocomplywithacountry’sAPIdatarequirements,airlineshavetogothroughacomplicatedprocess(e.g.configuringsystems,testingconnectivity,trainingstaff).Byengagingearlywiththem,yourcountrywillbeabletoknowwhatcanandcannotbeaccomplishedwithairlines’existingsystems.Forexample,intermsoftiming,itiseasierforairlinestocomplywithAPIsystemsthatareinalignmentwithinternationalstandards(3-6months)thanwiththosewhoarenot(24-36months).
32
• PublicauthoritiesshouldnotifyallstakeholdersoftheirintentiontoimplementanAPIsystem.
• Withregardstoairlines,thisinformationshouldnotonlybeprovidedthroughairport-basedAirlineOperatingCommittees(AOCs),butalsoviadirectcommunicationswiththeairlines'headquartersandwithIATA.
• WithregardstoITserviceproviders,companiescouldbeinvitedtosubmitarequestforinformation(RFI)toproposehowtheirsolutionscouldhelptheAPIprojectandwouldgiveanideaofcostandscopetoassistwithbudgeting.
Howtoengagewithstakeholders?
InformabouttheintentionofsettingupanAPIsystem
33
• NationalauthoritiesshouldconsiderthecreationofaNATFCthatwillincludealltheagenciesandMinistriesinterestedinhavingaccesstopassengerdata,aswellasnationalandforeignairlinesflyingintoandoutofthecountry.Thus,alistofallstakeholdersshouldbeformulatedandamendedasnecessaryastheprogrammedevelops.
• TheNATFCshouldbeinformedofplansandprogresstowardsestablishinganAPIprogramme,andcanhelpdevelopthedetailedtechnicalspecificationsthatmeetthecountry'sneedswhilefittingwithairlines'capabilities.
Howtoengagewithstakeholders?
CreationofaNationalAirTransportFacilitationCommittee(NATFC)
34
• Oncetheprogramisagreed,authoritiesneedtodevelopaCIG.Thisisamanualthatprovidesairlineswiththenecessarylegal,technicalandoperationalinformationrequiredtocomplywiththeirobligationsonAPIdata.
• Amongotherissues,theCIGshouldcoverallapplicablelegislation,themandatorystandardsfordatatransmission,thetimelineforcompliance,andalltechnicalinformationrelatedtodatatransmissionandformat,aswellasthesinglewindow.
Howtoengagewithstakeholders?
PreparationofaClientImplementationGuide(CIG)
35
• TheCIGshouldbeissuedatleast3to6monthspriortothepassengerdatatransmissionrequirement'sentryintoforcetoallowairlinestoprogramtheirsystems,testconnectivityandtrainstaff.
• Andremember...theclockonlystartstickingwhenthetechnicalspecificationsarereleasedandairlinesareabletostartprogramming!
Howtoengagewithstakeholders?
DistributetheCIGamongairlinestakeholders
36
• CommunicationwithairlinestakeholdersmustbepresentevenaftertheestablishmentofanAPIsystem.Forthispurpose,nationalauthoritiescouldusetheexistingBoardofAirlineRepresentatives(agroupwithalltheairlinesoperatingintoanairportorregion).
• ThePIU/singlewindowwillneedtodevelopasystemscommissioningprocesstoensurethatairlines'systemsaredesigned,installedandtestedaccordingtotherequirementsestablishedbythenationalauthorities.Certificationtestingdetermineswhetherconnectivityissuccessfullyestablished,whileconfidencetestingaimsatverifyingthatmessagesmeettheconstructionandthecontentrequirements.
Howtoengagewithstakeholders?
Developmentofasystemscommissioning
37
• NotallairlinesmightbeabletocomplywithAPIrequirementsbyacertaindeadline.
• ICAOdoesnotrecommendsanctionstobeimposedifanairlineiscooperatingorincaseofsystemfailure(arecommendedpracticeaccordingtoICAO'sAnnex9).
• Itisadvisabletohaveopencommunicationandflexibilityatthebeginning,aswellasdevelopingaselectiveenforcementofrequirementstoencouragecompliance.Oneofthepossibilitiesinthisregardistocarryouttheimplementationofyoursysteminphases/routesforspecificairlines.Implementationwouldthenbeexpandedascapacityisconfirmed.Anotherpossibilityistoissuewarningsincaseofnon-compliancethatcanresultinfinancialpenaltiesifairlinesdonotamendthesituationbeforeaspecificdeadlinedeterminedbytheauthorities.Sanctionsshouldalwaysbethelastresort.
Howtoengagewithstakeholders?
Beflexibleinapplyingthesanctioningschemefornoncompliance
38
LawEnforcement
ExternalCooperation
EnhanceinformationsharingwithotherStatesbilaterally.MakefulluseofINTERPOLdatabasesateveryStates’disposal.CooperationwiththeUnitedNationsandINTERPOLregardingwatchlistsanddatabases,butalsointermsofupdatesregardingnewintelligenceortargets.TheICAO,IATA,UNCCT,IOMandOSCEarealwaysavailabletoprovidetechnicalandpolicysupport.
39
Airlines
ExternalCooperation
ItisrecommendedtosignMemorandaofUnderstanding(MoU)withairlinestoagreeuponbasicprinciplesofcooperation,aswellasmessagetimingandprotocolsforsystemoutages.
40
BudgetConstraintsandInternationalCommitments BecausetheestablishmentofanAPIsystemisexpensive,identifyingpotentialbudgetconstraintsandopportunitiesisimportant.Fundingfromdonorstatesororganizationsmaybeavailabletohelpoffsetdevelopmentalcosts.
Statesshallseek,tothegreatestextentpossible,tolimittheoperationalandadministrativeburdensonaircraftoperators(ICAOStandard9.11).
Whiledonorfundingisimportant,theanalysisofthebudgetconstraintsandopportunitiesshouldtakeintoaccounttheissueofsustainability.ThisnotonlyreferstothecostofmaintenanceoftheAPIsystemafteritsimplementation,butalsotowhatwillhappenoncedonorsupportisover.
FundingforAPIimplementation
threemainalternativesforfunding:
41
1)PartnerwiththeWorldCustomsOrganization(WCO)forlaunchingaGlobalTravelAssessmentSystem(GTAS)GTASisareal-timepassengerscreeningsystemthatallowscustomsadministrationstouseAPIandPNRdataforriskassessmentpurposes.ItisavailablefreeofchargeaftercompletingaGTASIntakeQuestionnaire.Formoreinformation,[email protected]@wcoomd.org.
3)UseavailablefundsfromEUInstrumentforPre-AccessionAssistance(IPAII)2014-2020Strengtheningthematerialandhumancapacitytodetectandpreventirregularmigrationandimprovingthesurveillanceanddetectioncapacityoftheborderpoliceregardingallformsofcross-bordercrimearesomeoftheEUprioritiesIflinkedtoanyofthesepriorityareas,eachcountrycouldconsiderrequestingEUfundsundertheframeworkoftheIPAIIfordevelopinganAPIsystem.
2)DevelopanAutomatedTargetingSystem-Global(ATS-G)ProgrammeThiscost-freesoftwaresupportsAPIandPNRdatareceiptandprocessing,andisavailableaftersigninganMoUondataexchangewiththeUSCustomsandBorderProtection.Formoreinformation,[email protected].
42
Flexibility Cooperationwithothernationalagencies,withforeignStates,with
industriesandinternationalorganizationsshouldbemaintainedasmuchaspracticableduringthepreparationandimplementation
phases.
Authoritiesshouldalsoremainflexible,particularlyengagingwithairlines.Certaintechnicalaspects
mayrevealproblemspreventingfullcompliancebycarriers,inwhich
casetheyshouldnotbepenalizedasissuesarebeingresolved.Itis
recommendedthatthegovernmentresponsevariesbasedonthecarrier
effort.
Itisimportanttohaveinmindthat,despitealltheefforts,allmaynotgoaccordingtoplan.LimitedavailabilityofITresources,differentlevelsofITmaturityacrosstheindustryornon-realisticimplementationtimeframesmayhindertheprocess.Inthiscontext,itisnecessarytohaveafallbackplanprepared.
Thisroadmapshouldnotbereadinalinearway.MostofthestepsneededtoimplementanAPIsystemcomplementeachotherand,therefore,someactionscan(andshould)betakenatthesametime.
UNSCR2396(21December2017)andPNRdata
43
DecidesthatMemberStatesshalldevelopthecapabilitytocollect,processandanalyse,infurtheranceofICAOstandardsandrecommendedpractices,passengernamerecord(PNR)dataandtoensurePNRdataisusedbyandsharedwithalltheircompetentnationalauthorities,withfullrespectforhumanrightsandfundamentalfreedomsforthepurposeofpreventing,detectingandinvestigatingterroristoffensesandrelatedtravel,furtherCallsuponMemberStates,theUN,andotherinternational,regional,andsubregionalentitiestoprovidetechnicalassistance,resourcesandcapacitybuildingtoMemberStatesinordertoimplementsuchcapabilities,and,whereappropriate,encouragesMemberStatestosharePNRdatawithrelevantorconcernedMemberStatestodetectforeignterroristfightersreturningtotheircountriesoforiginornationality,ortravelingorrelocatingtoathirdcountry,with….resolutions1267(1999),1989(2011),and2253(2015),andalsoUrgesICAOtoworkwithitsMemberStatestoestablishastandardforthecollection,use,processingandprotectionofPNRdata;
PassengerNameRecord(PNR)• ICAOAnnex9StandardsandRecommendedPracticesforPNR(9.1,9.22,
9.23,9.24)• SingleWindow(currentlyRP,Standardinthenextedition)• PNRConditionalStandard,i.e.allPNRProgrammesmustalignwith
Standards• PrimarilyEDIFACT-basedsyntax(XMLalsodeveloped)• PNRGOVmessageformat• DataelementsaccordingtoICAOGuidelinesonPNRData(ICAODoc
9944)• PNRGOVMessageImplementationGuide(s)forEDIFACTandXML• Privacyimpact
LegendPNRinforce
PNRStatus:24States
Source:IATA
PNRAuthorizednotinforce
45
PNRandConflictofLaw• UNSCR2396(2017)urgesICAOtoestablisha
standardforthecollection,use,processingandprotectionofPNRdata.
• TheChicagoConventionisthecoherent,harmonizedlegalframeworktoregulate(API&)PNRtransfer(ICAOAnnex9SARPs,PNRGuidelinesandPNRGOVspecifications).
• However,thereisnoharmonizedlegalframeworktoovercometheconflictoflawasitrelatestodataprivacyandthetransferofPNRdata.
NextSteps:TheICAOAirTransportCommittee(ATC)taskedtheFacilitationPanelwithpreparingproposalsforStandardsandRecommendedPractices(SARPS)onthecollection,use,processingandprotectionofpassengernamerecords(PNR)inlinewithUnitedNationsSecurityCouncilresolution2396(2017)andreporttotheCommitteeduringthe218thSessioninOctober2019.
APIandPNR:Overview
ADVANCEPASSENGERINFORMATION PASSENGERNAMERECORD(DATA)
SECURITYTOOL(importancetohaveTravelDocumentscompliantwith
ICAODoc9303)
SECURITYTOOL
Serveslegalrequirement Servesairlines’operations40possibledataelements 60possibledataelementsorfields
(includingAPIdata)Collectionbyairline:flightopenforcheck-in
Collectioninreservationsystems:months/weeks
Mandatory:ICAOAnnex9Standard Notmandatoryatpresent(Annex9)
● Convention on International Civil Aviation, 1944 http://www.icao.int/publications/Pages/doc7300.aspx● Annex 9 — Facilitation ● Doc 9944, Guidelines on PNR Data ● WCO/IATA/ICAO API Guidelines http://www.wcoomd.org/en/topics/facilitation/instrument-and-tools ● API-PNR Toolkit https://www.iata.org/publications/api-pnr-toolkit/Pages/index.aspx
ReferenceDocuments
PassengerDataSingleWindowDefinition• A facility that allows parties involved in passenger transport by air to
lodge standardized passenger information (i.e. API, iAPI and/or PNR) through a single data entry point to fulfil all regulatory requirements relating to the entry and/or exit of passengers that may be imposed by various agencies of the Contracting State.
• Note.― The Passenger Data Single Window facility to support API/iAPI transmissions does not necessarily need to be the same facility used to support PNR data exchange.
BenefitsoftheSingleWindow• A facility that allows parties involved in passenger transport by air to lodge
standardized passenger information (i.e. API, iAPI and/or PNR) through a single data entry point to fulfil all regulatory requirements relating to the entry and/or exit of passengers that may be imposed by various agencies of the Contracting State.
• Increase in government requests for passenger data (based on new ICAO Standard 9.5 and UN Security Council Resolution calling for PNR S/RES/2368 2017
• A standard on a single window is necessary to limit costs and human resources for Contracting States implementing these requirements
• Single window improves data quality/consistency
SingleWindowProposedAmendmenttoAnnex9• 9.1. Standard: States should shall create a Passenger Data Single
Window facility for each or all data categories combined that allows parties involved to lodge standardized information with a common data transmission entry point for each category to fulfil all related passenger and crew data requirements for that jurisdiction.
• 9.2 Recommended Pratice: Contracting States iAPI) and/or PNR data from aircraft operators should consider creating a Passenger Data Single Window facility for all data categories combined.
• 9.1.1. Recommended Practice.— Contracting States should take measures for cybersecurity into consideration, when establishing a Passenger Data Single Window facility for passenger information
ICAO Facilitation Panel D.E. Raadgers
https://www.icao.int/Security/FAL/TRIP/Pages
BorderControlManagementGuide
Developedwiththesupportofanadvisorygroupofexperts
52
53
AutomatedBorderControl(ABC)gates3.34.4RecommendedPractice.—EachContractingStateshouldconsidertheintroductionofAutomatedBorderControl(ABC)systemsinordertofacilitateandexpeditetheclearanceofpersonsenteringordepartingbyair.3.34.5RecommendedPractice.—ContractingStatesutilizingABCsystemsshould,pursuantto3.9.2and3.10.1,usetheinformationavailablefromthePKDtovalidateeMRTDs,performbiometricmatchingtoestablishthatthepassengeristherightfulholderofthedocument,andqueryINTERPOL’sStolenandLostTravelDocuments(SLTD)database,aswellasotherbordercontrolrecords,todetermineeligibilityforbordercrossing.
54
Internationalcooperation:keyforsuccessfulimplementation
UNOCT
15thTRIPSymposium Montreal, Canada, 25-28 June 2019 With a dedicated interactive API session
This event is a world-class forumfortheexchangeofinformationona l l a s p e c t s o f t r a v e l l e ridentification management, andthe ICAO TRIP Strategy providingdecision makers and technicalexperts with valuable insight onkeycurrentandemergingissues.
55
THANKYOU!MERCI
56