RFID Passports Raise Safety Concerns

CurtMonash writes "CNNMoney.com features a skeptical article about the US State Department's plans to soon issue RFID passports (currently being tested on State Department employees). One fear is that they can be hacked for information about you. And even if they can't, carrying around a little transmitter saying 'I'm an American! I'm an American!' isn't a fun and safe thing to do in all parts of the world." From the article: "Basically, you've given everybody a little radio-frequency doodad that silently declares 'Hey, I'm a foreigner,' says author and futurist Bruce Sterling, who lectures on the future of RFID technology. 'If nobody bothers to listen, great. If people figure out they can listen to passport IDs, there will be a lot of strange and inventive ways to exploit that for criminal purposes.'"

Even if it can be hacked?

[blindbug]

One fear is that they can be hacked for information about you. And even if they can't...

It can... and it will be... period.

Re:yeah

[Anonymous Coward]

Americans aren't the only caucasians out there. RFID nicely allows somebody to identify the hated Americans from the nice Canadians (and most Europeans).

good business opportunity

[Anonymous Coward]

Time to start my business for "ePassport Sleeves" Put in a gaussian shield, and nothing to worrk about.

I am a free man

[LiquidCoooled]

Barring the bloody obvious target painted on you, they say in the article:

They'll have radio frequency identification (RFID) tags and are meant to cut down on human error of immigration officials, speed the processing of visitors and safeguard against counterfeit passports.

Human error will still occur in whichever system a human is involved in.

Couldn't they get all the same benefits with a simple barcode?
Does the RFID hold just your ID number for lookup on the database or is the RFID part now full identification?

I hope this doesn't go ahead (like the UK now isn't going ahead with its ID scheme) because whilst RFID might make tracking warehouse stock easy, its not great for humans.
Just because the technology exists doesn't mean we should use it for everything.

Re:yeah

[Potor]

What about Chinese Americans visiting their homeland?

Is This Madness?

[blueZhift]

Surely they cannot be unaware of how this could be exploited by those wishing to do harm to Americans, therefore I can only reach the conclusion that rfid passports are being pushed as a way for the government to ultimately track people in general. It would begin with being able to track foreigners and later as rfid makes its way into things like driver's licenses and auto plates, it could be used to track citizens. This is probably a goal of governments everywhere these days. First they'll tell you it's to stop terrorists, but with a flick of the switch, tracking citizens will be a breeze. I know the effective range is pretty short, but I can imagine that it would not be too hard for the government to build out an effective network, certainly in the most densely populated cities. It might even be able to piggy back on cell phone tower locations, so ordinary people wouldn't even know it was there. Ironically, true terrorists will be able to easily defeat this kind of tracking.

With every technology advance

[DarkDragonVKQ]

With every technology advance in security, there will be those who break it. And then another technology advance comes, that will be broken. We've been playing this cat and mouse game for nearly 5000 years. Nothing is going change.

Get yours now!

[Chris Pimlott]

US passports are good for 10 years from the date of issue. Get or renew yours now, before RFID becomes required.

Re:yeah

[slashdot-jake]

So what happens to the RFID when it goes through a dozen X-Ray scans? How about just sitting in my pocket at 35k ft? Have these chips been tested to show that they will continue to work after normal wear of a passport? My passport certainly takes a beating everytime I travel: x-rays, increased radiation due to high elevation, bending, humidity, etc. I doubt all these things have been tested for.

I really don't want to have to wait and hour and miss my flight as the prove that I am who my passport says I am just because some stupid chip failed.

The most workable solution?

[erroneus]

There are devices that shield RFID signals right? How about the state department design the passport in such a way that it prevents reading of the passport unless it's open. The cover should be shielded. If not, they should recommend keeping the passport in a shielded bag at all times unless it is being presented.

Either way, people can protect themselves whether it is in the design or not.

Re:Confused?

[Anonymous Coward]

In a November 2005 article, noted security expert Bruce Schneier states that the maximum distance at which an RFID chip had been read so far was 69 feet.

See "The Security of RFID Passports" in Crypto-Gram #0511 [schneier.com].

The article also has links to Schneier's other writing upon the subject.

Re:yeah

[Otter]

As cherished as this notion is among Canadians in particular (after all traveling the world with an enormous maple leaf on your pack and every article of clothing is just the epitome of class and good taste), I've been to four continents in the last year and a half, and have never encountered a shred of anti-Americanism. This whole issue is nonsense driven by 1) idiot Americans who have never left the country, 2) idiot Americans projecting their own disdain for their neighbors onto foreigners and 3) Canadians. Anyway, even if you're concerned about this stuff, why not travel, make a good impression and improve the US's image.

Meanwhile I see some guy here (you'll never guess from what country!) spinning a story of Americans pretending to be Canadian ON A CARIBBEAN FREAKING CRUISE! I'm sorry, if you're that stupid, don't leave home.

Re:Confused?

[Mayhem178]

As I understand it, in order to read an RFID chip, you have to be close. We're talking a matter of inches. So, not only would the guy with the reader have to know exactly where your card is on your person, but he'd have to shove the reader practically right up against you. I think you'd probably notice if he started rubbing you with his suitcase.

I'm not saying it's impossible, but I'm not losing any sleep at night over my RFID card.

Re:yeah

[TRS80NT]

And there are Asian-Americans, some of whom visit Asia.

Re:yeah

[tehcyder]

I've been to four continents in the last year and a half, and have never encountered a shred of anti-Americanism

In that case you either didn't go to Europe, or else you did and walked around with your eyes, ears and mouth shut.
I'm not saying it's right, but you're deluded if you think there isn't a lot of anti-Americanism around.
As for South America, Asia and Africa, I would be extremely wary as an American tourist. But you're probably OK in Australia or the Antarctic.

Re:Confused?

[Bastian]

You have it right. I used to go to a school which used RFID keycards to open doors. In that particular case, it wasn't even a matter of inches - the card had to be within about two centimeters of the reader.

It would take a heck of a lot more juice than what those readers put out to make something that's actually useful for reading these passport chips remotely. Assuming the effective range on the readers I've used was exactly 2cm, the inverse square law tells us that doubling the power my chip out (and keepin the reader's receiver at the same power) would increase the range to 2.83cm, quadrupling it would get us to 4cm, octupling it would get us up to 5.66cm. . . and by the time you get to the point where a potential passport snooper isn't making himself *really* suspicious by running around an airport waving his briefcase next to everyone's baggage, you've got yourself quite an RFID reader. And then you throw on the shielding that's being put into these RFID passports and it's back to square one.

Not saying it's impossible to make a device that effectively identifies Americans by their passports, just saying that everyone should probably put their tinfoil hats on now because a device like that would probably give you one heck of a headache.

Re:Confused?

[Shaper_pmp]

It's only passive until you bring it within range of a receiver.

That's secure in the same way as an object that's only invisible until you look at it, or a door that's only locked until you try the handle.

Passive RFID chips are likely harder to detect at range than active ones (for obvious reasons), but no-one's answered the question yet: Why do we need ranged querying at all?

Much, much safer would be a normal smart-card chip (like the one in your credit card) that requires physical contact to read anything. Frankly, once somone's got their hands on your passport it doesn't matter if it's a smart-card or normal paper one - they can easily find out things about you from it (or just nick it) at that point.

Allowing ranged querying seems to offer no really compelling benefits, and opens up a whole can of worms on issues like personal security, remotely tracking/identifying people without their knowledge, you name it.

Re:The Department...

[db32]

Valthan, you are a whiner. 1) That is a valid reference that people use to laugh about the way northerners speak. Its not even just Canadians though usually applied mostly to Canadians...almost EVERY northerner (specially north west) I have ever spoken to or hung out with has had the same accent. It was not started by southpark, it was started by northerners (including canadians) saying Aboot and Eh alot. In fact last time I had to deal with high level tech support it was a canadian guy...before the call was over I almost asked him to say "aboot" because he had said "eh" a dozen times already...but he said it without me asking and I about fell out of my chair (I hadn't slept in a few days fighting its problem so I was easily amused). Deal with it, many do say "aboot" and "eh" quite frequently. 2) You are right, with the exception of it makes Canada look like a terribly nice place to move to. So call it a real estate advertisement.

Re:yeah

[MaxInBxl]

I've lived in 6 countries (in 3 continents) including the US. I'm now currently in Europe where I'd say that there is a general disdain (not hatred) of Americans. I'd venture that this is due mainly to political issues.

From what I can tell, american tourists are not always well regarded by the locals because they are loud-mouthed and arrongant. Now yes, I will agree that there are some VERY loud american tourists, but for everyone one of them how many are there that go un-noticed?

Personnaly although I'm not very fond of your politics, your president and some of your louder country-men I go by the mantra that if an american has taken the steps to actually leave his country, if only brielfy, to see what else there is in the world then I should treat them with a minimum of respect and try and give a good impression of Europeans. For those fo you that enjoy that kind of thing: I'm French, feel free to flame on :)

Re:yeah

[Moofie]

Because the solution to our problems is MORE racism and bigotry. Yeah.

Re:yeah

[aclark]

In that case you either didn't go to Europe, or else you did and walked around with your eyes, ears and mouth shut.

I'd have to say that walking around with your mouth shut, or at least under control, is a pretty good way to avoid looking like an idiot anywhere you go. It saves you from making yourself (and the country you represent) look like an ass.

Having just come back from Europe (Rome, Nice, Paris & London), as an American (from Texas no less), I had nothing but good experiences with everyone I met. I can't say the same about the other idiot Americans who also happened to be staying at my hotel. In typical movie fashion they got louder and louder as the unfortunate hotel clerk tried to help them find a restaurant to eat at late at night. The more she had trouble understanding them they just got more irritated, annoying and bigoted. Standing there at the counter I felt so ashamed.

This isn't to say that Americans don't have a negative image in the world, but overall, people are smart and realize that not everyone conforms to the stereotype. My advice is to remember that you're not at home when you travel. Things don't go according to plan. Understand that you will have a hard time making yourself understood, but be polite. Don't leave the country if you're a rude, pompous, arrogant asshole (or leave and don't come back).

Re:What's the range?

[Sloppy]

How far are you broadcasting in the first place? If its like 10 feet who cares?

What a convenient tool for implementing an application named "proximity fuse."

Re:yeah

[call -151]

Two things:

1) Most people in Europe, Austalia, NZ and Asia that I have met realize that the Americans that they are likely to meet are not the ones who voted for Bush. The coasts have a much higher density of passport holders than the "Heartland," for example. (Active passport holders favored Kerry to Bush 58% to 35% [zogby.com].)

2) The "obnoxious American" stereotype is partly a result of biased sampling. If there are two Americans somewhere, and one is a fat, obnoxious, non-local-language speaking lout with a Hawaiian shirt and a camcorder and the other is a quiet, sensible, local-language speaker, the locals may not even notice that the second is an American, let alone remember the encounter. I am an American, and when I am in Europe, I am frequently mistaken as being Dutch, perhaps because I have a beard, a bicycle and can communicate passibly in any one of about five standard European languages, even if I don't happen to speak the local language. I also usually do not go out of my way to correct this misconception...

Re:real cause... Re:yeah

[rawdot]

The real problem is not their identification but the reason they are not liked.

Another problem is people who generalize about individuals based on their nationality.

Knowing that someone is a United States' citizen should not be the basis for inferring that that individual supports the U.S. government's current administration or its policies, foreign or domestic.

Should I assume any Italian supports Berlusconi? That any German is a member of the CDU? That Tony Blair is every Brit's personal spokesmodel? That any Chinese is a fervent Communist?

I believe we all generalize and stereotype to help us maintain a tractably sized model of our environment. But to act on those stereotypes when interacting with individuals is unsophisticated and unfortunate.

Cheers,
Richard

Re:Confused?

[katsiris]

Since RFID tags use the transmitting signal to send a reply, the strength and therefore distance that it will transmit or echo is dependant largely on the signal of the detector. Obviously the tags themselves can't rebroadcast an infinitely large signal, but the fact that you needed to get close to the doors at your school is a design feature of the doors and not a limitation of the technology. After all, they don't want doors unlocking just because someone is walking by...

Re:yeah

[Roody Blashes]

There's a difference between anti-Americanism as a political and social principle and being anti-American as a matter of bigotry. When people speak of anti-Americanism, they generally are referring to the fact that, as far as the world is concerned (and correctly so) your political, military, and social behaviors are insane, dangerous, and belligerent.

However, as a matter of treating Americans individually, we tend to find you to be rather amusing people, whether because you create crazy spectacles that are entertaining to watch, or because you're simply and interesting people. Personally, I wouldn't want to live with you, but I certainly don't harbor any ill will as far as, for example, sitting in a pub and chatting it up a bit.

Furthermore, anti-Americanism as a security principle is entirely different. Americans are not hated, even by the bigots, to the point that normal people would attack them, but if you are easily identified as an American, you make an easy target for anybody looking to make a political statement. Because Americans, really, have so little to fear from terrorism, your news agencies always make a big deal about kidnapped or murdered Americans, so it's a good way to get an extreme political agenda face time. That, however, is a matter of opportunistic criminals and terrorists lurking in the crowds. The crowds themselves aren't going to mob you just because you're American. You may be shunned by some people for your country's disrespectful behavior toward the world, but for the most part we tend to look at you as people under the thumb of a violent and corrupt government, not as a violent and corrupt people.

Even the French, who you've been insulting for years (and who have been insulting the world for even longer) don't actually hate you as individuals. There's really very little ill will towards the American public, because we simply don't view you as being the same as your political views, and we can agree or disagree with you on whatever level is necessary for the current topic of conversation.

Re:Confused?

[Jah-Wren Ryel]

by the time you get to the point where a potential passport snooper isn't making himself *really* suspicious by running around an airport waving his briefcase next to everyone's baggage, you've got yourself quite an RFID reader.

Of all the possible threat models, you've picked the least likely. If you are in an airport you can probably just look at the guy's luggage tags.

No, the threat is out in the real world where there is plenty of opportunity to disguise super-huge equipment. Like a doorway where the entire frame is a field generator and detector and the target is still only a few inches away, or the entire trunk of the car parked along the roadside, or along the sidewalk where the wall of that warehouse you are strolling by is just a thin piece of wood and on the other side is a some big-ass (and relatively cheap since there is no need to miniaturize) detection equipment.

Not saying it's impossible to make a device that effectively identifies Americans by their passports, just saying that everyone should probably put their tinfoil hats on now because a device like that would probably give you one heck of a headache.

Yeah, because humans have that 6th sense - the one that lets us detect EM waves. If you are lucky, maybe your watch will stop working, or your cell phone will drop a call and crash. Neither of which are particularly obvious clues to the layman that he's been whacked with a ton of EM.

BTW, here's a guy demonstrating a system to detect these RFIDs from at least 50 ft and who claims it goes a lot further. Note that whether or not he actually reads any of the data from the RFID is irrelevant, the fact that you've got one in the first place is plenty of information all on its own. http://blogs.pcworld.com/staffblog/archives/000798 .html [pcworld.com]

Re:Confused?

[natet]

You are basing your assumptions on the fact that there will be no advances in the technology involved with RFID readers. The fact that you had to be within a very short range for your school tag to be read doesn't mean that it will always be the case, or that your school didn't just go with cheap tech instead of a nicer reader. Further, the field to power the tag itself may be small, but what's the broadcast range of the tag? Could someone with a passive reader pick up the signal from your tag being read at a border? The research mentioned in the article seems to indicate this is possible.

Now, I must point out, that this article is based on old assumptions. As someone else pointed out, Bruce Schneier has been talking about these passports for some time, and has provided a number of suggestions to the government about how it can handle many of the issues he has raised. The current implementation calls for shielding in the covers of the passport that would render it unreadable when closed. If that works as advertised, then many of the issues that Bruce has with the passports are nullified.

Re:yeah

[hey!]

or else you did and walked around with your eyes, ears and mouth shut.

Well, I find that mouth shut and ears open does tend to improve one's chances of making a positive impression.

Unfortunately, there is a small minority of my fellow Americans who seem to get this backwards. And what comes out of their mouths tends to be stupid and ugly.

Remember the run up to the war, the big stink about France? France's crime: disagreeing with us about strategy (all the while cooperating with us on the parts of the strategy they agreed on). It's impact on us: nil. We went ahead and did what we pleased, and at least the part of the war that was within our planning horizon went as perfectly as it was possible to have it go. So our reason for acting like France was some kind of bully that pushing us around was pretty lame.

This was hardly America's worst hour, but it may well be our most embarassing.

Re:yeah

[feepness]

Of course the Estadounidenses dont know that because they are happy drinking Tequila and dancing until they fall in their expensive (not a lot for them of course) hotels and "Planet Hollywod" and "Hard Rock Cafe" (I have always wondered *why* do they bother to travel to Cancun if they are going to get into the same places they have in the USA).

Plus I hear they constantly stereotype people from other countries! Stupid Americans!

Sorry, but you don't sound like someone it's particularly worthwhile being "real" friends with. Tell me, how do you treat your "fake" friends? What if I'm one of them and don't know it? Guess I don't need to worry about either, being born in the wrong country and all.

Re:yeah

[pianophile]

I'm French, feel free to flame on :)

How about an anti-flame? I'm an American that loves France. On behalf of my country I would like to apologize for all that anti-French, "surrender monkey", "freedom fries", etc. stuff. All of that was/is shameful. Yes, we helped France a lot in WW1 and WW2, but we wouldn't have survived our Revolution without your help, and thanks for staying out of our Civil War, too, by the way. I hope that one day our countries are once again the great friends and allies we once were. I love your wine, your food, your films, your women :-)

Vive la France!

Re:yeah

[jonin]

How exactly does that work? If the coasts have higher rates of passports (one would assume that means they travel more) and they tend to be blue states, wouldn't that suggest most travelers including the large, obnoxious ones are more likely be liberal?