Privacy Threat in New RFID Travel Cards?

DemolitionX9 writes to tell us ZDNet has an interesting article rehashing the problems with privacy in future RFID-equipped travel documents and ID. The piece focuses on a recent speech given by Jim Williams, director of the Department of Homeland Security's US-VISIT program. From the article: "Many of the privacy worries center on whether RFID tags--typically minuscule chips with an antenna a few inches long that can transmit a unique ID number--can be read from afar. If the range is a few inches, the privacy concerns are reduced. But at ranges of 30 feet, the tags could theoretically be read by hidden sensors alongside the road, in the mall or in the hands of criminals hoping to identify someone on the street by his or her ID number."

Terrorism applications

[Animats]

RFID takes terrorism to the next level. The next step, of course, is the land mine that only blows up when someone from the US is near it.

And yes, some terrorist groups do have the capability to build custom electronics. You can see examples of IRA custom circuit boards in the Imperial War Museum [iwm.org.uk], London.

No control

[Billosaur]

Many of the privacy worries center on whether RFID tags--typically miniscule chips with an antenna a few inches long that can transmit a unique ID number--can be read from afar. If the range is a few inches, the privacy concerns are reduced. But at ranges of 30 feet, the tags could theoretically be read by hidden sensors alongside the road, in the mall or in the hands of criminals hoping to identify someone on the street by his or her ID number.

Unless the Feds are going to come up with an air-tight encryption scheme, this is a recipe for disaster. This isn't like the EZPass I have on my car, which is only linked to my account and determines if I have enough to pay the toll. These chips will potentially carry a lot of personal and very useful information, especially if you're a crook looking to use somebody's id to get across the border or to create fake identity documents for sale.

Frankly, this whole idea is mainly a panacea. If it works, the bad guys will simply sneak across the thousands of miles of undefended and unmonitored border we have in the US. Others will start turning innocent people into mules by swiping their identities and using them to get things across. Instead of making the borders of this nation more secure, the government is creating even more insidious ways for someone to come into this country. I think it's time to go back to the drawing board.

What about more powerful scanners

[Onymous Hero]

Could more powerful or modified scanners be used to read the RFID chips only designed to be read from a short distance?

IANARFIDE (I Am Not An RFID Engineer) ;)

I'm not sure if this applies But What About..

[u16084]

Mastercard and their PAYPASS cards? https://mbe2stl101.mastercard.net/hsm2stl101/publi c/login/ebusiness/mobile_commerce/paypass/index.js p/ [mastercard.net] Its RF also .. The range is about 2 inches... Im able to pull up to a gas pump, swipe my wallet next to the scanner and off im go. heres the documentation on their stuff https://mbe2stl101.mastercard.net/hsm2stl101/publi c/login/ebusiness/mobile_commerce/paypass/document ation/index.jsp/ [mastercard.net]

Re:practically speaking

[dwandy]

Maybe it is no different than today's threats, just new; "Why add another way to get hijacked?" should be the real question asked here, not "How is this different?". And if you believe that just because it's just a number you're safe, you just havn't thought it all the way through. From 30-ft, a disguise doesn't have to be perfect. And if you start by picking someone who looks somewhat like you, you can pretty much move around as them.

So, imho, it is different due to the perceived infallibility of computer reports (which is a joke, since all those same people who claim it must be true 'cause the computer said so, also say their computer crashes all the time)
So I guess where I'm going with this is that if I can forge your chip, I can then move about leaving *your* electronic trail behind. Then when something goes bad the cops show up at your house, not mine.
I guess it's kinda like being able to scan and replicate your DNA from 30 ft. If I can then leave it somewhere you *will* be convicted...they won't even talk to me: I wasn't there.

Re:practically speaking

[jim_v2000]

Lots of ways, most immediately comes to mind:

      1. Capture your data.
      2. Encode to my chip.
      3. Now I'm you, I can:
      4.
                    * Travel as you.
                    * Commit various offences as you
                    * Do whatever I want as you, and hell, the computer can't be wrong.
      5. (mandatory) PROFIT!


Kinda like when an illegal alien decides to use a stolen SSN?

(I was buying a car last week and two Hispanic gentlemen where attempting to finance a truck, and I overheard the lady doing the loan paper say something about how the SSN had been used on another account with different info already.)

Sniffer

[J05H]

One potential threat for American travellers carrying this kind of chip is a sniffer weapon. The hi-tech version is an RFID sensitive smart missile and the dumber version is an IED in Cairo that sits and waits for Joe Sixpack to walk by. If you think I'm full of it, the Russians used a cell-phone sniffing missile to kill a Chechen general. For US RFID passports in other countries, all the munition needs to do is detect the chip's presense.

I want my "papers" to stay paper, please. Bar code them or whatever, but don't delibrately make it prone to identity theft, hacking or IEDs.

Josh

Re:Lay off the Philip K Dick.

[rossifer]

You'd also have to have the same finger prints and iris geometry...and that isn't on the card.

You didn't RTFA. The whole point of this card is so that people don't have to open their car windows or slow down at border crossings because the current border crossings interfere with commerce.

When cars are moving past the checkpoint at 30-60mph, which of the machines there are going to check finger prints and iris geometry again?

Regards,
Ross

Re:I don't get it!

[scronline]

Security and convience don't exist in the same sentence or device. You can't have one without the other.

I don't see the difference with long lasting...a chip is a chip. For that matter, why can't a magnetic strip be used since it's supposedly just holding a unique number that is used to contact a database anyway?

So you're going to tell me that a radio signal is more reliable than a direct connect? I want some of what you're smoking.

Re:practically speaking

[tarkas]

Perhaps we're asking the wrong questions. The various faults of remotely read RFID-like devices used as ID's have been beaten like a dead horse over the last few months; RFIDs are sorely wanting. If the intent is only to provide a mechanism to ease border crossings; even it's pretty iffy - there are too many competing methods that are more secure, and less expensive to implement.

If, however, your goal is not to provide a fool-proof form of Passport, but rather to normalize the use of a remotely (and covertly) polled identification device in the general population, then it works well. Regardless of their potential usefulness and the presumably good intentions of the developers, they are the perfect tool of an authoritarian government. As such, we use them at our peril; it doesn't require much imagination to think of ways such things could be used to monitor and shape the behaviour of a given citizenry. And no this is not anti-GOP rant. In this case the party lines are more like the incumbents vs. the rest of us.

DMV agent: Oho, it appears you were in close proximity to a known radical several times last year. It also looks like you were in a bookstore looking at political titles no less than 20 times! Your travel license (ex-drivers license?) is now restricted to areas that are safer, to protect you from dangerous ideas. Deviations will be noted. Anomalous sequencing of scans will be noted. (Ain't computers grand?) Anomalous lack of registrations will be noted (foil pockets - forbidden). We have to keep a look out for dangerous people seeking to harm the American People's children!

That's Six Inches???!!!

[Stephen Samuel]

The DHS, put out a Request For Information (RFI) looking for someone who had the technology to read ID tags from 25 feet away at 55MPH [bcgreen.com]... Through the skin of a bus... All the passengers at once.

They seem to suggest that they only want it so that they can identify people stopped at border checkpoints.

Talk about marking yourself with a bullseye ....

[Gorshkov]

From the article:
RFID chips are already going to appear in U.S. passports starting in October 2006, the Bush administration ruled last October.

a) That's gonna seriously screw up some american tourist's habit of wearing maple leaf emblems on their clothing/backpacks so they can claim to be Canadian.

b) Congrats - you just enabled every wanna-be terrorist to be able to track down and find an american in any crowd. Gonna make it much easier to figure out which foreign tourists you want to kidnap, don't you think?