Passport Chip Sets Security Concerns

[question everything]

The Wall Street Journal

Passport Chip Sets Security Concerns
By STACY A. ANDERSON
August 9, 2006; Page D11

A new kind of U.S. passport with an embedded chip containing personal data will be issued starting Monday, amid some concerns about privacy and its vulnerability to hacking.

The State Department says it has chosen the chip technology in the so-called e-passports as part of an effort to better secure U.S. borders by making passports harder to forge. Congress also passed an act requiring countries in the U.S. visa-waiver program to issue passports with such chips by October. The technology is designed to make it easier for customs officers to verify travelers' identities. Travelers will simply present their e-passports to customs officials the old-fashioned way. Officials will open the passport and scan the characters on the bottom of the personal-data page. The border official then verifies the personal information from the chip that is encrypted and transferred to the screen of a special e-passport reader machine.

Privacy advocates charge that the technology hasn't been sufficiently tested, and some experts have recently found ways to pull data off the radio-frequency-identification, or RFID, chips in e-passports in other countries. But other technology-security experts say such fears are overstated, saying that the perception of e-passports as being unsafe comes from confusing RFID tags with contactless technology, such as that used on some ATM and credit cards. The retail industry uses RFID to track merchandise, crates and pallets. Contactless technology can calculate and store new information that is often encrypted for security purposes.

(snip)

The Department of Homeland Security has run trials at various airports, while State Department personnel have also tested the new passport. The State Department says it has addressed key privacy concerns by adding metal sheets to the document's cover. These metal fibers make the chip inactive and data unreadable when the passport is closed, the State Department says. The chip can only be read by a scanner within a three-to-four-inch distance, says Joerg Borchert of Infineon Technologies North America Corp., which supplies the State Department with chips.

For added security, the chip will also have an electronic-access-code system, known as the Basic Access Control, which will be automatically read by U.S. border officials' scanners. The system generates a key which opens the chip and makes reading personal information possible. If the chip in the electronic passport were to fail, border officials would revert to relying solely on the printed personal-data page within the passport.


URL for this article:
http://online.wsj.com/article/SB115506010992230068.html (subscription)

Design of the new passport

http://travel.state.gov/passport/eppt/epptnew_2807.html