RFID Passports

Since the terrorist attacks of 2001, the Bush administration--specifically, the Department of Homeland Security--has wanted the world to agree on a standard for machine-readable passports. Countries whose citizens currently do not have visa requirements to enter the United States will have to issue passports that conform to the standard or risk losing their nonvisa status.

These future passports, currently being tested, will include an embedded computer chip. This chip will allow the passport to contain much more information than a simple machine-readable character font, and will allow passport officials to quickly and easily read that information. That is a reasonable requirement and a good idea for bringing passport technology into the 21st century.

But the Bush administration is advocating radio frequency identification (RFID) chips for both U.S. and foreign passports, and that's a very bad thing.

These chips are like smart cards, but they can be read from a distance. A receiving device can "talk" to the chip remotely, without any need for physical contact, and get whatever information is on it. Passport officials envision being able to download the information on the chip simply by bringing it within a few centimeters of an electronic reader.

Unfortunately, RFID chips can be read by any reader, not just the ones at passport control. The upshot of this is that travelers carrying around RFID passports are broadcasting their identity.

Think about what that means for a minute. It means that passport holders are continuously broadcasting their name, nationality, age, address and whatever else is on the RFID chip. It means that anyone with a reader can learn that information, without the passport holder's knowledge or consent. It means that pickpockets, kidnappers and terrorists can easily--and surreptitiously--pick Americans or nationals of other participating countries out of a crowd.

It is a clear threat to both privacy and personal safety, and quite simply, that is why it is bad idea. Proponents of the system claim that the chips can be read only from within a distance of a few centimeters, so there is no potential for abuse. This is a spectacularly naÃ¯ve claim. All wireless protocols can work at much longer ranges than specified. In tests, RFID chips have been read by receivers 20 meters away. Improvements in technology are inevitable.

Security is always a trade-off. If the benefits of RFID outweighed the risks, then maybe it would be worth it. Certainly, there isn't a significant benefit when people present their passport to a customs official. If that customs official is going to take the passport and bring it near a reader, why can't he go those extra few centimeters that a contact chip--one the reader must actually touch--would require?

The Bush administration is deliberately choosing a less secure technology without justification. If there were a good offsetting reason to choose that technology over a contact chip, then the choice might make sense.

Unfortunately, there is only one possible reason: The administration wants surreptitious access themselves. It wants to be able to identify people in crowds. It wants to surreptitiously pick out the Americans, and pick out the foreigners. It wants to do the very thing that it insists, despite demonstrations to the contrary, can't be done.

Normally I am very careful before I ascribe such sinister motives to a government agency. Incompetence is the norm, and malevolence is much rarer. But this seems like a clear case of the Bush administration putting its own interests above the security and privacy of its citizens, and then lying about it.

Ah, so you have a single key to decrypt every passport the US issues? Hmmm... There might be a problem with that. Would we allow other nations to read our passports? If so, it might as well not be encrypted. Would we want to be able to read the passports of other nations? Judging from this article, I'd say so. Again, crypto wouldn't be useful in such a case because the "secret" would be known by far too many untrustworthy parties.

What exactly do you think will be stored on these RFID tags? The passport number, which is perferated through the top of the passport already. The person's name and address, which is already printed on the first page of the passport. The person's fingerprint, which is already on the person's finger. That's it. An RFID chip makes it very difficult to forge or alter a passport for someone else's use, and it makes the entry of the passport number into the Immigration computer to track entries and exits less error prone.

It's not as if you're storing your entire credit history on the darn thing. And yes, I would want other countries to include a compatible RFID system in their passports, or else the system is pretty much useless. That would imply that other authorities would also be able to read our passports and upon entry to their country verify my fingerprint matches the one stored in my passport, just as they make sure the picture matches my face.

Well, I'd say that when you are travelling is the time that you would be most at risk of having someone scan it unbeknownst to you. When I go to the local grocery store, I figure that most of the folks there are American. The times that some nefarious evildoer would most likely be interested in knowing someone's nationality is exactly when someone would be most likely to have it on their person.

If all it is that they are storing on it is your number, name, and some biometric like a fingerprint, then encryption is not necessary and would, in fact, be a hindrance to the system, as you'd have to deal with the messiness of distributing the key, (which wouldn't be able to change without difficulty).

So, now you are travelling through Europe with a passport that is broadcasting your identity and biometrics to anyone who wants to read the information. Still not a good idea IMO. Not that it matters because people will use whatever they are given even when their government is doing something terminally stupid.

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.