US Passports - RFID Cards Get Spin Treatment

[helderheid]

*NOTE TO THE MODERATORS - this is printed in full due to the fact that it is an email only newsletter*

Conspiracy theorists and civil libertarians, fear not. The U.S.
government will not use radio-frequency identification tags in the
passports it issues to millions of Americans in the coming years.

Instead, the government will use "contactless chips."

The distinction is part of an effort by the Department of Homeland
Security and one of its RFID suppliers, Philips Semiconductors, to
brand RFID tags in identification documents as "proximity chips,"
"contactless chips" or "contactless integrated circuits" anything
but "RFID."

The Homeland Security Department is playing word games to dodge the
privacy debate raging over RFID tags, which will eventually replace
bar-code labels on consumer goods, said privacy rights advocates
this week.

An RFID tag is a microchip attached to an antenna, which transmits
unique information to a reader device that can be anywhere from a
few inches to several feet away. The technology, with its many
names ("contactless chips" has been around for some time), is used
in security access cards, E-ZPass automatic toll-paying devices and
ski-lift tickets.

Computer scientists and data-encryption experts, the editors of an
RFID industry journal even the makers of the contactless chips
themselves all agree that the Homeland Security Department is
using RFID technology.

But the Homeland Security Department is very carefully avoiding use
of the term "RFID." The department, along with Philips, is also
backing a trade group that is branding ID documents with RFID tags
as "contactless smartcards."

Joseph Broghamer, Homeland Security's director of authentication
technologies (see bio below)

"We'd prefer," said Joseph Broghamer, Homeland Security's director
of authentication technologies, "that the terms 'RFID,' or even
'RF,' not be used at all (when referring to the RFID-tagged
smartcards). Let's get 'RF' out of it altogether."

The Homeland Security Department this spring will begin issuing
RFID-tagged employee ID cards (which include fingerprint records) to
tens of thousands of its employees. Homeland Security's employee ID
card has "contactless" technology to speed workers' access to secure
areas, said Broghamer. He also wants to replace conventional reader
devices, because their metal contacts break down after repeated use.

The department is also evaluating technology pitches from several
RFID tag manufacturers, including Philips, for an RFID-tagged
passport containing biometric data. The government's plan will earn
billions of dollars for the RFID suppliers while helping security
officials track individuals more effectively by detecting their ID
documents' radio signals in airport terminals, or wherever reader
devices are present.

The Homeland Security Department and Philips said they worry that
the public will confuse the RFID tags in ID documents with those
used by retailers, such as Wal-Mart, to track consumer goods.
Contactless chips, said Broghamer, are more sophisticated than
retail RFID tags, because they can carry more information and can
better protect sensitive personal information.

But there is another problem with the "RFID" name: Many people
associate the term with radio chips "that blab personal information
indiscriminately" to any reader device, said Lee Tien, senior staff
attorney at the Electronic Frontier Foundation.

Privacy rights groups such as the EFF, the American Civil Liberties
Union and CASPIAN have for years argued that RFID tags on consumer
goods could be used to spy on individuals.

That is why Homeland Security is engaging in doublespeak, to dupe
Americans into accepting RFID tags on their passports, said Barry
Steinhardt, director of the ACLU's Technology and Liberty Program.

"It's a frightening, Orwellian use of the language," said
Steinhardt, referring to the "contactless" branding effort.
Steinhardt called the RFID tags the Homeland Security Department is
using, which have faster processors and more storage capacity than
retail tags, "RFID on steroids."

Government agents will use reader devices to track individuals
wherever they use their RFID-tagged identification documents,
Steinhardt and Tien said.

"They can call it a contactless chip," said Tien, "but it is still
RFID. And it shares virtually all of the same vulnerabilities."

Identity thieves will be able to lift an RFID-tagged passport
holder's personally identifiable information with reader devices
that can be purchased for less than $500, said Steinhardt.

Terrorists could also track down and kidnap Americans oversees by
secretly reading their chipped passports.

"Let's say you are in Beirut, carrying a passport with an RFID tag,"
said Steinhardt. "A terrorist with a portable reader device could
easily tell who is the American (in a public space)."

University of California at Berkeley assistant professor David
Wagner, who researches computer security and cryptography, has
reviewed engineering studies of the type of RFID tag that will be
used in passports. Wagner called Steinhardt's terrorist scenario
"absolutely conceivable."

"And," said Wagner, "unlike an ID with a bar code or magnetic strip,
you'd never know your card has been read."

Homeland Security's Broghamer insisted that the contactless chips
for ID documents are vastly different from RFID tags used in retail
supply chains, because contactless chips must be held very close to
a reader device to be activated and to transmit their data.

RFID manufacturers are typically making radio tags for ID documents
that comply with ISO/IEC 14443, the contactless chip industry
technology standard. This standard limits transmission ranges to a
distance of about 4 inches. Other RFID tags can be read at
distances up to 30 feet, making them easier targets for identity
thieves trying to capture their data, said Broghamer.

Broghamer would not admit to something engineers testing ISO/IEC
14443-compliant chips have demonstrated, however: that electronic
eavesdroppers up to 30 feet away can capture data (including
biometric records) while it is being sent by the chips to an
authorized reader device.

ISO/IEC 14443-compliant chips can also be read directly over much
longer distances by specially built devices, according to a Tel Aviv
University study (.pdf).

Broghamer seemed eager to stay on-message about the Homeland
Security Department's name for its RFID technology, despite its
apparent vulnerabilities.

"I nearly fell out of my chair," Broghamer said, when he read a
Wired News report that the Homeland Security Department's employee
ID card will include an RFID tag. "I never used the term 'RFID,'"
said Broghamer, describing a presentation he made at a technology
conference last month. "I only used 'contactless chip' or
'proximity chip' to describe it."

A Philips sales executive, however, testifying last summer to the
House Committee on Energy and Commerce, called contactless
smartcards "RFID systems with advanced computing power, storage and
strong encryption accelerators, offering advanced services with
enhanced security and privacy protection."

The Homeland Security Department's employee ID card will use
state-of-the-art authentication and encryption systems to protect
the department and its employees from identity thieves and spies
with unauthorized RFID tag readers, said Broghamer.

But the chips in passports will not have any of those digital
security features, said Homeland Security Department spokeswoman
Kimberly Weissman. "We want it to be compatible," she said, "with
as many reader devices used by other countries as possible."

Until next issue stay cool and remain low profile!

Privacy World

-----------------------------------------------------------------------------
To subscribe, send a blank message to [e-mail]

[Benhurst]

1. Recommended NT

[helderheid]

2. Big Brother is watching you!

[helderheid]

3. thanks for the recs - scary stuff this.

[PATRICK]

4. Same rationale and doubletalk

as any other tech monster like e-voting and wiretapping and "harmless" spyware. The fact that the capacity for this will be loaded onto society like a bunch of harmless empty boxes on Normandy IS the important privacy and personal security breech. Whether all else follows now or later is not relevant to the fundamental question being successfully evaded each and every GD time.

[helderheid]

5. Is this beast too big to slay? Are we officially in 1984?

[n2doc]

6. one can shield/jam the chips and render them ineffective

See:
Computer security software maker RSA Security on Tuesday introduced a new technology for protecting information emitted by radio frequency identification tags.
http://news.com.com/2100-1029-5164014.html

and:
One time-honored, low-tech way to prevent tags from being eavesdroppedskimmed is the "Faraday Cage." A Faraday Cage is a metal enclosure that prohibits radio frequency signals from passing through it.
http://www.rfid-weblog.com/50226711/building_a_faraday_cage_in_clothing_to_shield_rfid_tags.php

and:
How to make an RFID blocking wallet:
http://www.rpi-polymath.com/ducttape/RFIDWallet.php

No reason not to be prepared.

[helderheid]

7. THANKS for this!!

[PATRICK]

8. The privileged and in the know

people will have all that of course. The ordinary slob who thinks he has nothing to fear and whose paranoia is misdirected would never find it easy to get or use such information. The fear machine would be excluded. The wild amateurs outside the game and more importantly, the mass of humanity, would be collared.

Therefore for all loss of general freedom we would never be protected against astute terrorist or smart amateurs. And the ruling class would find it easy to exclude themselves from the common ranks of suckers.
The biggest fools of course would be those in the establishment who go along with this charade without being in the inner circle or even understanding what the renegade circle is.

[Gabi Hayes]

9. not so fast! it's easier than you think! see?

[dogday]

11. I'll see your tin foil cat ,and raise you one

[tyedyeto]

10. Any target date as to when this will happen re: passports? n/t