Americans - new passport proposals

[LHR02]

From a special edition of the travel insider newsletter comes this info.....and I have to admit this idea scares the bejesus out of me!

Monday 28 March, 2005

Good afternoon

Imagine, while traveling overseas, that you're wearing a big target on the back and front of your shirt saying 'American traveler'. One of the things we're taught to do is to prudently blend in with other people, no matter where we're traveling.

Of course you wouldn't choose to wear a sign saying 'I'm an American tourist', but the State Department is proposing a new type of passport that would have the same effect. Which is why I'm sending you this special newsletter now - we have a short term opportunity to try and prevent this.

In a misguided attempt to make our passports more secure, the State Department is proposing to embed an RFID chip into every passport. This chip will contain our personal details - name, date of birth, passport number, and even a digital picture, and can be read by anyone reasonably close with an RFID chip reader.

Anyone from petty thieves and pickpockets, up to identity thieves, kidnappers and terrorists would love to know who in a crowd is an American foreigner and therefore an easy victim. Another way to abuse this information is to just hang out at an airport and get the details of departing passengers - their houses may be unattended and good choices to burgle.

This data is stored, unencrypted, in the chip. If the government wants to make our passports more secure, other technologies exist that don't have these downside risks.

The State Department acknowledges these risks, but says in response that to 'skim' this information is technically very difficult. That probably means it would take a 16 year old two hours to build the necessary skimmer/reader device, using off-the-shelf and inexpensive components.

The State Department says these chips can only be read from 4" away. Here's a device openly for sale for only $299 that can read RFID chips from 450 ft.

The State Department has also suggested people could wrap their passports in tinfoil to insulate them from people with unauthorized readers!

The State Department is accepting comments on this proposed change to our passports through next Monday. If you don't like this idea, why not write to the State Department and tell them.

(a) The most convincing form of communication is a personal letter, addressed to

Chief, Legal Division
Office of Passport Policy, Planning and Advisory Services
2100 Pennsylvania Ave NW
3rd Floor
Washington, DC 20037

But if you're going to send a letter, you need to get it in the mail, now, to beat the deadline.

(b) Alternatively, you can send an email to

[e-mail]

(c) Alternatively, you can go to this website - RFIDKills.com - operated by well known consumer crusader Bill Scannell, and fill out the form he provides and have it sent off for you.

(d) Why not send copies of your letter/email to your senators and congressman, too; so that they know what is proposed to be enacted by regulation rather than legislation by the State Department.

Keep your comments brief and positive, and simply say, in your own words, that you feel adding RFID chips to passports adds unacceptable risk and privacy compromises, and ask the State Department to consider other/better solutions to the need to enhance passport security.

Here is the full official notice of proposed rulemaking about the RFID chips.

Please pass this email on to other people and encourage them to act as well.

Until Friday, please enjoy safe travels

David M Rowell aka The Travel Insider

[WillTravel]

Here are a couple of articles on it:
www.wired.com/news/print/0,1294,65412,00.html
news.com.com/New+high-tech+passports+raise+snooping+concerns/2100-1039_3-5469533.html

[MuvverRussia]

We're going the same way in the UK. From UKPS:

In line with ICAO recommendations, the UKPS will deploy contactless integrated circuit media (i.e. a computer chip) of sufficient capacity to facilitate storage of the facial image and at least one additional biometric identifier. A contactless chip includes an aerial to allow close proximity readings, i.e. without being swiped through a reader. Modern contactless chips are paper-thin and therefore particularly suited to being incorporated in passport books or passport identity cards.

Sounds like RFID to me, although I'm personally in favour of it. It'll make passports more secure. Also, RFID isn't a big thing anyway - both my Uni ID card and tube pass have it, many stores use it (including the UK's biggest supermarket chain - Tesco) etc.

[Libby]

My original reply seems to have dissapeared.

Anyway....what they are proposing here is pretty damn scary. Really! Identity theft is one thing, but this smarts of government tracking..sorta.

[Marie]

They actually tested tham out recently but the scanners were only capable of reading about 20% of the chips which is not realy a succesful trial run. Out of the 8 or 9 countries participating in the trial run, because every country would have it's own type of chip, only 4 were able to give in prototypes to try out and none seemed very impressive! So at least we seem to have a little time before this becomes reality and we all become science fiction heros!

[Eagle]

It's certainly not surprising that RFID has infiltrated the Passport department. I suppose it was a logical progresssion, as RFID is touted to be the replacement for bar codes for "point of sale" and other applications in the very near future ("coming to a Wal Mart near you!"). Since many current Passport designs use bar codes, it's natural that RFID will be the next generation.

From what I can gather, these are being developed for a variety of applications. The obvious one is retail sales and inventory managment. Apparently Wal Mart is one organization that is pushing hard to have this implemented, and they've given their suppliers a time limit in which to have the chips installed in ALL products they sell. However, a lot of the "privacy watchdogs" are worried about an invasion of privacy unless the chip can be "killed" at the time sale is made. Their concern is that retailers or whomever could install readers to the entrances of shopping malls, theatres, etc. and track people using the chips embedded in the clothing (or whatever) they're wearing or carrying (including pants, shirts/blouses, shoes, purses, backpacks, etc.).

I've heard that the U.S. military has been testing RFID for tracking pallet loads of materials being transported, and this has been very successful so far. It's proposed that eventually individual items will be equipped with the chips as well, in order to facilitate easier inventory and tracking of items.

These are a similar technology to "prox readers" used for access control. I believe that some of these can be read from a far greater distance than 4-inches. Since the chips are a "passive" device, I suspect that the power level of the transmitter / reader is the determining factor?

I have some privacy concerns with this technology, given the big increase in cases of identity theft lately. It's probably less of a problem with something like a company I.D., (everyone knows who I am at work) or a library card (wouldn't contain much sensitive information). However, in the case of confidential personal or credit information, I'm not too anxious for others to easily have access to this type of information. One thing we can all be sure of, is that it won't take the criminal element long to figure out a way to begin scamming this new technlogy. How do we determine who has the right to view this information, especially if it's un-encrypted?

I wonder how long it will take the the Canadian Passport office to follow suit, given the co-ordinated approach to "fortress North America" that seems to be emerging.

Interesting stuff and certainly something to monitor!