The Olympic Games. How Paris 2024 wants to fight counterfeit tickets

This is one of the problems. This Thursday at 1:00^eh In December, the first round of ticket sales for the Paris 2024 Olympic Games opens, representing three million tickets. A question in the background is how to protect against fake tickets and avoid a situation similar to the Champions League final where many fake tickets were created. Ten million tickets will be sold during the entire process.

The specific box office will be rolled out over time. This Thursday at 1:00^eh Those who want to buy tickets in December and for two months (until January 31, 2023) can register for the lottery without removing their bank card. Then, the drawn people will receive an email from the beginning of February 2023. Then the user can make his package with the possibility of buying up to 30 tickets. Finally, at the end of 2023, the final phase of unit sales will begin.

Le Figaro reviewed the techniques implemented by the organizers and presented them to two cyber security experts.

Distribute a sale

These multi-stage sales aim to reduce the waiting time of users at the online box office. “This avoids an increase in concurrent connectionssays Damien Rajeau, director of on-site commercial operations at Paris 2024.At major events like the Olympics, robots could buy multiple tickets to resell on the black marketwarns ESET France cyber security expert Benoit Grunemwald. Dazzling is a good idea“.

The second point – providing the ticket to the buyers. “Tickets will only be sent for a few months or weeks [la durée exacte n’a pas encore été tranchée par les organisateurs, NDLR] before the eventsays Damien Rajot . “Counterfeiters will have less time to organize», he wants to believe. Is “time is indeed on the organisers’ side“, it will not stop malicious persons.To breakif they want to break», however, assures Benoit Grunemwald.

End of paper tickets

Paris 2024 has also decided to no longer use paper tickets with barcodes, which are more easily counterfeited. “These printed tickets can be photocopied or even photographed multiple times. Security checks will stop duplicates, but someone who honestly bought their ticket from a reseller might still be able to get in.», explains Damien Rajot.

Instead, the organizers are betting on the QR code, these two-dimensional barcodes that are especially used during the Covid-19 pandemic for health vouchers. “active” where”dynamic“. “It contains various information and its icon is movable», Damien Rajot elaborates.

A specific QR code, or what it contains, evolves over time, unlike more traditional QR codes. If Paris 2024 did not want to communicate data that would be different, “iFor example, there are systems where the active QR code will change depending on the time», reveals Thibaut Henin, cybersecurity expert and writer for the cybersecurity popularization website Read Arsuyes.

Obviously, the QR code generated at 10:01 am will no longer be valid at 10:02 am because another one will automatically replace the previous one without the ticket holder having to do anything. Both experts interviewed agree that this type of technology is much more secure than a paper ticket. “It started spreading around 2015Thibaut Henin assures. For him, the democratization of the smartphone explains why this system is used more today. According to INSEE, by 2021, 77% of people over the age of 15 in France will have a smartphone.

The human factor

However, the organization recognizes that no system is impenetrable, no matter what precautions are taken. In particular, the possible media piracy on which those tickets will be stored, the smartphone. “It doesn’t matter when tickets become available, it doesn’t stop hackers from creating a platform», attests cyber security expert Benoit Grunemwald.

According to him, potential ticket buyers may receive an email urging them to click on a link that will discreetly install malware. Such a system, which mainly exists on Android smartphones, could capture the phone’s screen or record the typed text. And therefore restore access codes, for example, to the ticket office. “An organization can create whatever it wants, if a user is vulnerable, the entire chain is vulnerable», sums up Benoit Grunemwald. Another challenge.