Passport card with chatty RFID chip draws privacy ire
New chipped passcards are unencrypted and readable up to 30 feet away
Computerworld - A proposed new RFID-enabled passport card intended for use by Americans frequently traveling to Canada, Mexico, Bermuda and the Caribbean poses serious security and privacy risks for users, the Center for Democracy and Technology (CDT) warned this week.
Among the concerns are the potential for the government and private entities to use the card for location tracking and the relative ease that the card can be manipulated for identity theft purposes, the CDT said.
The Washington-based think tank's warning was prompted by a final ruling in the Federal Register from the U.S. Department of State on Dec. 31 calling for the use of so-called vicinity read radio frequency identification (RFID) technology on proposed new passport cards. The department first announced plans to use RFID chips for new passport cards back in October 2006 and has been going through a process of collecting and responding to comments on its plans.
The identification cards would be needed by residents who don't have passports for verifying their identity at land, air and sea border crossings. They are to be issued as part of the Departments of State and Homeland Security's Western Hemisphere Travel Initiative, or WHTI. The credit card-size passport cards will use vicinity-read RFID technology, allowing customs and border protection officials to read them from at least 20 to 30 feet away. The goal is to substantially reduce wait times at the border by allowing officials to access and queue up an individual's information even before he reaches the official.
The approach is substantially different from the proximity-read technology being used in U.S. electronic passports, and it offers fewer protections, according to Ari Schwartz, deputy director at the CDT. Electronic passports contain all of the same identification data that appears on the first page of a passport, and includes a digital photograph and a digital signature. But the information on those chips is encrypted at all times and can only be accessed by physically swiping the card through a reader at the border crossing.
In contrast, said Schwartz, the proposed RFID-enabled passport cards can be read from a distance, and without user notice, consent or control over when the information is collected. Additionally, information from the card is transmitted in the clear -- that is, without encryption. The RFID technology itself is also more susceptible to electronic eavesdropping and hacking, which makes the cards less tamper resistant compared to electronic passports, he said.
"So you have a situation where you are sending out identity information in the clear over a long distance," using a less-than-secure technology, Schwartz said.
The State Department itself has said that the passport cards will not contain any identity information such as name, date of birth, Social Security number or place of birth. Instead, all it will contain is a unique identifying number that will be used to access a cardholder's identifying information, which is stored separately on a secure Customs and Border Patrol system.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts