RSSRFID-Equipped Passports Come to U.S.
By Ed Oswald | Published August 15, 2006, 12:11 PM
Federal officials said Monday that United States passports equipped with RFID tags would soon begin to make their way to consumers, with its Colorado Passport Agency being the first to produce the documents.
Although the federal government insists the passports are safe, security researchers say the data on the tags can be compromised.
Researchers at the Black Hat conference in Las Vegas earlier this month showed how RFID tags could be read and copied to a smart card, which in turn could be used to make a fake passport. Such issues could pose massive security risks, especially as airport officials are again trying to clamp down on security at international airports.
However, the warnings are not stopping the federal government from going ahead with its plans. The rest of the country's passport distributing offices will convert to the new system by October of this year, the State Department said. Federal officials are already carrying the new devices under a test program conducted by the agency.
The State Department said it has taken a "multi-layered approach" to prevent data from falling into the wrong hands. Metallic anti-skimming technology has been included in the front cover and spine of the passport, which it says would not allow the data to be read when the passport is closed.
Other technologies such as Basic Access Control, which requires a key be read to unlock the chip, a randomized unique identification (RUID) to prevent tracking of an e-passport holder, and an electronic signature are all features intended to keep the passport holder's personal data intact.
"The Department of State is confident that the new e-passport, including biometrics and other improvements, will take security and travel facilitation to a new level," it said in a statement.
Moreover, features such as the digital photograph embedded in the data would practically make it impossible for a person to use a passport unless they looked similar to the person, say officials.
Just out of curiosity, what biological data are you refering to?
They do not collect fingerprints, iris scans or any other biometric information in the process of applying for a passport...so.....unless your system is even more psychic than suspected, what data base are they going to be comparing our none-existent data with?
And, everyone seems to miss the point that the primary purpose and use of a passport is for FOREIGN travel and return! I haven't had to use my passport to go from Dallas to Chicago to SFran to NYC in awhile! Not to mention going to Gatlinburg in the Smokies!
So exactly how will this "facilitate travel and take it to a new level"? Here is an idea. Instead of trying to prove that I am who I am based upon biometric data which they do not have (which proves next to nothing), wouldn't it make more sense to compare my ACTUAL data on my person with a database of known bad guys? Or do you also propose putting all of the 'non-lost' kids faces on milk cartons and having the FBI list all of the 'non-top 10' unwanted on posters in order to find those that are 'lost' or 'wanted'? That is what this check does! As aside from the PICTURE, all you are doing is making sure the Passport agrees with a database, not authenticating my ACTUAL biometrics! Why not simply have my actual Hand scanned during processing and compare my actual fingerprints against a database of known bad guys?
And, as mentioned, as Passports are used for foreign travel, foreign governemts will not necessarily have access to my PERSONAL information - nor do I want foreign governments having this! So is all of this simply to make sure that a doppleganger or an imperfect clone is not trying to return home in my place?
The problem is that of defining exactly what we are assuming is being accomplished aside from some amorphous "we will be safer" mantra has not been thought through.
Besides, RFIDs are easily zapped. As I have traveled to many places where I do not particularly desire to wear a big "I am an American tourist" T s*** broadcasting my personal info! If the RFID has mysteriously ceased to function (go figure!) then they will have to resort to actually looking at the passport and seeing if I look like my mug shot!
If it actually facilitated a real security strategy in a tangible manner it would be one thing, but....
Score: 0
|I think he ment Higth, Weight, finger print, eye color, etc. Not actual DNA or bio-matter.
Score: 0
|Even though it can be copied, it cannot be used anyway. There's more security measure than just that one, like biological detail, etc.
Score: 0
|"Researchers at the Black Hat conference in Las Vegas earlier this month showed how RFID tags could be read and copied to a smart card, which in turn could be used to make a fake passport. Such issues could pose massive security risks"
Hello! Is this thing on? Which part of that statement don't these brainiacs don't understand? When will the general public get outraged enough to put a stop to this type irresponsible behavior? Hey! I know...if we wrap the passports in duct tape and plastic sheeting that should slow down any potential risk!
Score: 0
|Really really baaaad idea.
:eek:
Score: 0
|Oh good. That makes it VERY useful. So when someone accesses a foreign checkpoint that doesn't have the capability to access this central US repository....the usefulness is?
And that sounds great. Might the government want to start taking biometric and fingerprint data to compare the data with? It currently does not exist and the application process does not include this data harvesting!
I suggest anyone interested in this read Bruce Schneier's column. He addresses the entire proposed capability in depth, and the resulting picture is not pretty!
Brought to you by the same folks who brought you: 'Of course them Internet pipes do become pretty full and clogged! So you never know if this will work or not until they are able to install them bigger pipes!' :))
Score: 0
|The chips should only carry a referance number on them and the government make use of the internet to conect to a government database that contains picture and biometric data so all the customs agents have to do is use the reader and tell the person to place their hand on the finger print reader to make sure everything matches up and in order for everything to match up the people using stolen ids would still have to get their photo and finger prints onto the governemt database.
Score: 0
|Unfortunately, RFID chips can be read by any reader, not just the ones at passport control. The upshot of this is that travelers carrying around RFID passports are broadcasting their identity.
Think about what that means for a minute. It means that passport holders are continuously broadcasting their name, nationality, age, address and whatever else is on the RFID chip. It means that anyone with a reader can learn that information, without the passport holder's knowledge or consent. It means that pickpockets, kidnappers and terrorists can easily--and surreptitiously--pick Americans or nationals of other participating countries out of a crowd.
Not only that, but a reader can be hidden anywhere and hooked to a wireless Wi-Fi transmitter and the data remotely harvested without any indication of who is doing this.
Bruce Schneier and others have justifiably beaten this braindead - but oh so convenient- horse to a pulp!
But that's OK, RFIDs are easily disabled.
Funny, they haven't yet delineated the procedure for handling a dysfunctional Passport. Heaven forbid, they just MIGHT have to read it!
Oh, and regarding the ideal 'let's compare the data with a central database. That's great if we are dealing with first world countries where the risk is minimal to begin with. But MANY places and checkpoints around the world - as someone just MIGHT choose to use the passport to actually , say, 'travel' - barely have electricity, let alone high speed online access!
Score: 0
|My passport doesn't expire for another 4 years thank God. Hopefully all the bugs will be worked out by then. I still think this is a great idea in theory, but pratically we don't know enough about the technology to use it for something as huge as passports.
Score: 0
|Why store information on the RFID chip? The RFID should be just that an ID number that brings up the coresponding passport informaiont stored in the US Customs data base.
When I was traveling to Europe last year I noticed the US Customs ran the edge with the number on it through a reader (the readers use OCR simmiler to a check reader) and then they conpaired the picture and information on the passport to what was in the data base.
That is all the RFID should do too.
Score: 0
|The code could possibly be stolen and transferred to a blank chip. Then placed in a forged passport, but someone would have to gain access to the backend database at the same time because....like you said....the pictures wouldn't match up.
I’m more concerned about being “tagged,” with a transmittable signal. At least with a barcode if it's in your pocket, no one else knows it's there. A whole range of things could be triggered to start a process just at the meer detection of a signal. (advertising, warning messages, trap doors, whirling disks of death, etc.)
Score: 0
|I hate whirling disks of death. Last time I got hit with one of those it about severed my arm off.
Normally this would be the spot for some sort of comment about putting on a tin foil hat. If you are trying to block RFID, wouldn't you need a tin foil jock strap (ouch) or a tin foil fanny pack (I can see them now)?
Score: 0
|NICE...
Time to have some fun with RFID.
I think someone found a way to duplicate RFID tags recently...
Score: 0
|Does anyone know if there are any penalties to disabling the RFID chip?
Score: 0
|Only destroying an identity paper, which carries a fine.
Score: 0
|