Feds Rethinking RFID Passport

This Wired News story says that due to "criticism from computer security professionals and civil libertarians about the privacy risks," the U.S. State Department is rethinking how it plans to embed RFID chips into US passports. Apparently, much of the "feedback" came to a head at the Computers, Freedom and Privacy conference last week in Seattle.

According to the story, Barry Steinhardt, director of the Technology and Liberty Program for the American Civil Liberties Union, refuted the government's claim that the chip had a read distance of only 6 centimeters by demonstrating a chip being read from two to three feet away at the conference. Others have claimed the read distance can be much larger. The article quotes Frank Moss, deputy assistant secretary for passport services, saying that these demonstrations, along with continued feedback, was enough to prompt the government to reconsider Basic Access Control, or BAC, a means of protecting the data on the chip that the feds had rejected earlier. The article describes BAC this way:

The data on a passport would be stored on an RFID chip in the passport's back folder, but the data would be locked and unavailable to any reader that doesn't know a secret key or password to unlock the data. To obtain the key, a passport officer would need to physically scan the machine-readable text that's printed on the passport page beneath the photo (this usually includes date of birth, passport number and expiration date). The reader would then hash the data to create a unique key that could be used to authenticate the reader and unlock the data on the RFID chip.

The story goes on to say that BAC prevents skimming because because remote readers can't access the unless the passport is "physically opened and scanned through a reader." Proponents claim that BAC can prevent eavesdropping by encrypting data in transit from the chip to the reader. BAC was created by the International Civil Aviation Organization, and the Wired article points to both the specification and a report based on tests that have been run on working systems.

The concern over RFID-enabled passports is completely understandable, given the privacy and security issues that they stir up. In short, leaving data unprotected in an identity document intended to have such a long life cycle just doesn't seem like a good idea. But I'll have to admit a cringe a bit when I see sites like this use over-amped scare tactics in fighting RFID passports. Here's a quote:

"In a dangerous world where Americans are targeted by thieves, kidnappers and terrorists, the RFID-chipped US passport will turn tourists into targets, and American business travelers will transmit their identities to kidnappers wherever they go . . ."

Americans are targeted, and that's a serious issue. But as Bill Terrill, one of network and telecom analysts, pointed out in an email exchange, average Americans identify themselves abroad in many ways, most of which don't require and RFID reader. (A few examples: Wearing white running shoes with slacks and a sports coat, talking in audible tones, not to mention yelling English words louder so people who speak another language can understand them, flying an American airline, and frequenting American hotel chains. And if you're of enough interest to gain the attention of a "terrorist or kidnapper," then you're already a potential target.)

I'd prefer to see the case against these things made in more reasoned and grounded terms, and it sounds like folks made some progress in that direction at the Computers, Freedom and Privacy Conference. I'm hoping that the intentions reported in the Wired article to revisit the idea are sincere, and am glad to hear that the State Department is considering at least adding data protection to the chip. (I still for the life of me can't figure out why they just didn't do this from the beginning. Are they really surprised about the reaction?)

Whether BAC works as advertised is another question altogether, one I'm sure we'll be hearing more about.