U.S. passport privacy: Over and out?

[R.A. Hettinga]

<http://www.iht.com/bin/print_ipub.php?file=/articles/2004/12/22/news/passport.html>

 



U.S. passport privacy: Over and out?

By Hiawatha Bray The Boston Globe
 Thursday, December 23, 2004


 It's December 2005 and you're all set for Christmas in Vienna. You have
your most fashionable cold-weather gear, right down to Canada's national
red maple leaf embroidered on your jacket and backpack, to conceal your
American citizenship from hostile denizens of Europe.

 But your secret isn't really safe. As you stroll through the terminal, you
pass a nondescript man with a briefcase. The briefcase contains a powerful
radio scanner, and simply by walking past, you've identified yourself as an
American. Without laying a finger on you, the man has electronically
"skimmed" the data in your passport.

 Science fiction? The American Civil Liberties Union doesn't think so.
Neither does Bruce Schneier, software engineer and author of multiple books
on computer security, nor Katherine Albrecht, a privacy activist in
Cambridge, Massachusetts. They are all worried about a State Department
plan to put radio identification tags in all future U.S. passports,
beginning next year.

 That way, American passport data can be read merely by waving it past a
radio detector. But whose radio detector? That's what worries many people.

 "Somebody can identify you as an American citizen from across the street
because of the passport in your back pocket," said Albrecht, founder of a
Web site concerned with the matter, spychips.com. "You're a walking target."

 Nonsense, replies a State Department spokeswoman, Kelly Shannon. "We're
going to prevent the unauthorized skimming of the data," Shannon said.

 The U.S. government thinks the new passports will be harder to forge and
easier to verify than the current model, without causing undue risk of
identity theft.

 It is all part of the continuing debate over radio frequency
identification systems, also known as RFID. Tags that let people zoom
through a highway toll booth contain an RFID chip. Many American pets have
them embedded under their skin and the U.S. Food and Drug Administration
has approved doing the same for people, to provide reliable medical
information to emergency room doctors.

 But privacy advocates like Albrecht contend that government agencies and
big corporations want to embed RFID chips into virtually every product,
giving them the ability to track almost every move that people make.

 The RFID chips contain a tiny bit of information that is transmitted via
radio when the chip comes within range of a reading device. The chip could
broadcast a simple code number, or it could contain a lot more information,
like a traveler's name, nationality and digital photograph. This is what
the chips planned for future U.S. passports will do, part of a plan to make
the passport system more secure.

 But according to government documents released by the civil liberties
union, early versions of the system allowed detection of personal data by a
snoop 30 feet, or 9 meters, away. Shannon, of the State Department,
dismissed this research, saying the equipment needed to capture the data
was too complex and heavy to be used undercover.

 That is not much comfort to Schneier, the computer security expert.
"Technology only gets better," he said. "It never gets worse."

 Schneier figures that would-be spies and snoops will find ways to pick up
signals from the passport chips.

 The chips might be made more secure by encrypting the data they contain.
That way, it would be useless even if intercepted. But the State Department
opposes that idea, because immigration officials in many poor countries
cannot afford the necessary decryption gear.

 "Encryption limits the global interoperability of the passport," said Shannon.

 Why use a radio-based identity system at all? Smart chips, like those
found in some credit cards, are plentiful and cheap, and they don't
broadcast. You slide them through a chip reader that instantly scoops up
the data.

 But the International Civil Aviation Organization, which sets global
standards for passports, has decided on the use of a "noncontact"
technology - another way of saying radio-based identification.

 So will Americans be stuck with high-tech passports that beam their
personal data to all comers? Not necessarily. Turns out there's a simple
fix: a passport cover made of aluminum foil. It would form what engineers
call a Faraday cage, after Michael Faraday, the 19th-century British
physicist who discovered the characteristics of electromagnetic waves.

 Wrap an RFID chip inside a Faraday cage, and the electromagnetic waves
from the chip reader can't get in and activate the chip.

 The State Department says it may use the principle to give travelers an
added sense of security. No, there won't be rolls of aluminum foil included
with every passport. Instead, the passport cover may include a network of
wires woven into the fabric. Fold the passport shut, and there's your
Faraday cage.

 Even Schneier agrees that a properly shielded passport cover should solve
the problem. He wonders why this wasn't included in the original plans for
the new passports.

 "It took a bunch of criticism before they even mentioned it," Schneier
said. And he hopes the anti-snooping technology is thoroughly tested before
the new passports are introduced next spring.


-- 
-----------------
R. A. Hettinga <mailto: rah at ibuc.com>
The Internet Bearer Underwriting Corporation <http://www.ibuc.com/>
44 Farquhar Street, Boston, MA 02131 USA
"... however it may deserve respect for its usefulness and antiquity,
[predicting the end of the world] has not been found agreeable to
experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo at metzdowd.com