When the chip is stolen: can digital identity remain secure after a document is compromised?
In Italy, three biometric identity cards with their microchips removed with unusual precision were discovered within a matter of days. The cases raise a question that goes beyond the physical protection of a document: what happens to digital identity when its carrier is compromised?
In Campania, southern Italy, the Carabinieri recorded three cases within a few days involving biometric identity cards from which the microchips had been removed. According to Regional Obala, citing RaiNews, investigators have so far found no connection between the individual cases.
What is particularly notable is the manner of removal. The chips were reportedly removed so precisely that the intervention cannot be explained by ordinary damage or wear. The investigation is ongoing; one possibility being examined is the use of the removed chips in identity abuse or counterfeit documents.
This does not mean that such abuse has actually taken place.
But the cases raise an important question for the future of digital identity.
What happens when an attacker steals not a password, but part of an identity?
An electronic identification document is designed so that the physical document and its electronic component together enable more reliable identity verification.
But no security element should become the single point of trust.
If an attacker obtains a physical identification element, a modern system should still be able to distinguish between a valid identity element and the legitimate holder of the identity.
In the recent Fideuram fraud case, we discussed the possibility of voice abuse or imitation. This time, a physical element of the document may have been compromised. Tomorrow it could be a phone, password, biometric pattern or another credential.
The question is therefore no longer only: “Is the credential valid?”
It is also: “Can we verifiably prove that it is being used by its legitimate holder and that the holder approved this specific action?”
How would the QEI concept approach this problem?
QEI – Quantized Encrypted Identity is a research concept of Institute 1. april that does not treat digital identity as a single document, chip or collection of personal data.
In such a model, the following principle should apply:
POSSESSION OF A CHIP ≠ PROOF OF A PERSON
The validity of a chip or other credential would represent only one element of verification. For a sensitive digital action, the system should verify a broader chain of trust:
CREDENTIAL VERIFIED
Is the digital element being used valid?
IDENTITY BINDING VERIFIED
Is the credential still validly linked to the identity anchor?
LEGITIMATE HOLDER VERIFIED
Is the action being performed by the person to whom the credential belongs?
AUTHORITY VERIFIED
Does that person have the right to perform the requested action?
INTENT VERIFIED
What does the user actually intend to do?
ACTION AUTHORIZED
Has the user verifiably approved this specific action?
Only then would execution follow.
A stolen chip should not mean a stolen identity
This is one of the key research principles that such a case raises for QEI.
If someone physically obtains a chip, phone, card or another identification element, they should not automatically obtain the identity of its owner.
In QEI, it would therefore make sense to separate the identity of the person from the credential used to prove that identity.
If a particular credential is compromised, it could be revoked. The person’s identity does not disappear because of that.
Instead of STOLEN CHIP → ACCESS, the system should work approximately as follows: STOLEN CHIP → VERIFICATION → INVALID OR REVOKED CREDENTIAL → DENIAL.
What about biometrics?
Biometric data also requires particular caution. A password can be changed. A fingerprint generally cannot.
For this reason, in our research approach biometrics should not become a universal key that is directly handed to every service. The purpose of QEI is the opposite: whenever possible, the system should prove to a service only what it needs to know.
A bank, for example, may need proof that IDENTITY VERIFIED, not a copy of a person’s biometric data. Another service may need only AGE ≥ 18 VERIFIED, rather than a name, date of birth, address and biometric data.
“The safest personal data is often the data that never had to be disclosed to the service at all.”
— Institute 1. april
From document theft to authorization of an action
The cases of removed chips reveal something else: proving identity alone is not enough.
Imagine someone using a compromised credential to enter into a contract or take out a loan. Even if the first identity-verification step were passed, a sensitive action should still require verifiable authorization.
For example: PERSON A → EUR 20,000 loan → BANK B → specified terms → explicit authorization.
Authorization of a different amount, contract or recipient would not be the same authorization.
This leads to a broader principle: IDENTITY ≠ CREDENTIAL ≠ AUTHORITY ≠ AUTHORIZATION.
Identity says who you are. A credential helps prove that you are really that person. Authority defines what you are allowed to do. Authorization proves what you actually approved.
“A stolen identification element should not mean a stolen identity. Digital identity must remain verifiable even when one of its security elements has been compromised.”
— Institute 1. april
A new generation of attacks requires a different trust model
The cases in Italy matter primarily as a warning about how broadly we need to think about digital identity.
Attackers may try to obtain a password. They may imitate a voice. They may fake an image. They may steal a device. And, as the latest discoveries indicate, someone may also physically interfere with an electronic identification document.
The future of digital identity therefore cannot rest on the assumption that any single element will always remain secure.
A more robust question is: How do we build a system that remains secure even when one element fails?
This is one of the areas we want to explore in the further development of the QEI concept.
“The future of digital identity will not depend only on how well we protect an individual key, chip or device. It will also depend on whether the system can safely survive their compromise.”
— Institute 1. april
Note: The cases involving removed microchips remain under investigation. Publicly available information does not establish that the removed chips were actually used for identity theft, loans, contracts or other abuse. QEI – Quantized Encrypted Identity is a development and research concept of Institute 1. april. This article describes how this type of risk could be addressed within the proposed QEI concept; it does not claim that QEI has already been implemented or that it would certainly have prevented the specific cases.
