Privacy vs. Security: Biometric E-Passports

ftblguy writes "Countries such as the UK, Belgium, Netherlands, Canada, US, Australia, and New Zealand are currently looking into adding RFID chips to citizens' passports. The chips would contain data such as a digital image of the person's face. A real-time facial scan of the carrier of the passport would then be matched to the data encoded in the chip. But privacy advocates such as CASPIAN are concerned that this data could get into the hands of the wrong people or that governments could use the data to track their citizens as they go about their personal business. But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security."

Comments

Just wait

[sugapablo]

Soon they'll want to implant RFID tags (or something similar) in your left molar. Everyone will be able to be traced from a simpe computer terminal. Great for parents who's kids are kidnapped, or hikers lost in the mountains, bad for everyone else.

Re:Just wait

[SpooForBrains]

Surely better to implant it in a part of the body that can't be removed by a half qualified dental assistant?

Re:Just wait

[denthijs]

And all in good spirit of a non existant terror threat.
America hasn't put itself on a threatlevel lower then orange and probably never will.
A quote from 1984 might be the best justification for this;

The war isn't meant to be won, the war is meant to be continuous

I only hope the US-citizens will see this for what it is and not re-elect another 4 years of warmongering.

Re:Just wait

[danormsby]

But why do this with RFID as a unique tag? Surely our faces or speech or irises are unique enough. Hold a database of those rather than implant another unique key?

Re:Just wait

[Everleet]

I only hope the US-citizens will see this for what it is and not re-elect another 4 years of warmongering.

If we had a choice, we probably wouldn't. Unfortunately that issue, along with every other issue the government faces, has already been decided by the Party. The public has the oh-so-heavy choice of which face reads their speeches for the next few years.

Re:Just wait

[Rakshasa Taisab]

They're propably going to implant it in a part of the body that you'd rather never lose.

Re:Just wait

[88NoSoup4U88]

As of a month, when making a photo for a dutch passport, you are not allowed to smile ; as this would disturb the 'default' position from where all the other positions of the face can be determined (for face recognition) : This info is embedded within the passport.

Re:Just wait

[e r i k 0]

And if you got a sex change?

Re:Just wait

[Anonymous Coward]

Well I think that a lot of these efforts to make passports "secure" are based on a misunderstanding of what a passport is. A passport is not a permanent ID which is what it seems programs like this are confusing it with. Passports are travel documents and that's it. They're not intended to be any more than that and this is why they're not a good basis for a permanent ID system.
Not only is it a necessary and unalterable fact that passports must be chaanged quickly and regularly, it is a fact that Americans cannnot even keep their same passport number from one document to the next even if they want to. A passport is a fluid document that is only useful for a limited period of time and that makes passports a lousy basis for a foolproof ID system.

Re:Just wait

[flossie]

Soon they'll want to implant RFID tags (or something similar) in your left molar. Everyone will be able to be traced from a simpe computer terminal. Great for parents who's kids are kidnapped, or hikers lost in the mountains, bad for everyone else.

No, RFID won't be effective for satellite monitoring. This GPS implant might, however.

Re:Just wait

[Anonymous Coward]

and you think the liberals will NOT do the same thing???

just remember who SIGNED the DMCA into law when YOU vote.

right now the differance between the republicans and the dems is the republicans are in office... that is the ONLY diff.

get off your bush hating BS it is very old and tiring. bush is not differant that any of the other main stream polititions. and john "doubble talking" kerry is not presidential material.

vote constitution party and then we will hopefully get back to our roots.

Re:Just wait

[Anonymous Coward]

They just arrested 7 people in Pakistan with 50 bombs. Yes Osama bin Laden is just a fairy tale. Terrorism is all just some right wing conspiracy to take away your rights. Do you want me to go on showing you how stupid you are, as well as the moron who modded this trash up as insightful?

Re:Just wait

[TheGavster]

Yes, we should vote out the guy who signed the Patriot Act and launched us into war in Iraq, replacing him with the guy who voted in favor of the Patriot Act and approved going to war in Iraq. A brilliant plan!

Re:Just wait

[Anonymous Coward]

Show me the 50 bombs.

Who's believing a fairy tale?

"They're doubting us again, better arrest a lot of people and say they had bombs. Who's been pissing us off the most lately?"

Re:Just wait

[NuclearDog]

I'm not even American, so I'm not really biased either way and may be talking out of my ass, but AFAIK Kerry voted to invade Iraq if the UN supported it. Although, I agree with you, it isn't even the lesser of two evils anymore, both parties seem more or less identical.

ND

Re:Just wait

[quarx]

let me guess, in the eye?...

Re:Just wait

[counterplex]

Think of it as a surrogate primary key ;)

Re:Just wait

[rastos1]

Because getting a new RFID is easier as getting a new face/speech/iris.

Think identity theft.

dupe

[mishmash]

dupe!

Re:dupe

[Anonymous Coward]

I don't know how long you've been saving that up, but thank you for coming through with it. Pure gold :) If only Funny got Karma...

Ho hum.

[Anonymous Coward]

I probably wouldn't object to this idea, if I just knew that I could turn it off.

Not effective

[lachlan76]

This is NOT a secure system, since you could put in a fake picture of a face into a passport.

Biometric systems are not secure as a means of authentication, they are too easy to fake.

The three ways you can authenticate a person are:

1. What they are
2. What they have
3. What they know

A good security system combines at least two of these. This one does, but since it only authenticates against what you have, it is not very good. If each passport had a key encrypted with a passphrase (like in PGP), and you needed the passphrase to use it, you would have good protection against stolen passports.

But these don't do that.

Re:Not effective

[Justin205]

Why don't we all just use our GPG keys as our passports (basically)? Seriously, it'd be better than the system currently in place...

Re:Not effective

[lachlan76]

Or put the encrypted private key onto an RFID chip along with a normal passport, so that we need to match the photo as well.

Re:Not effective

[Anonymous Coward]

You're just copy-pasting Bruce Schneier without understanding it. The content of the RFID can be encrypted using a kind of encryption that only your government can decode/encode.

This solves the "data could get into the hands of the wrong people" part.

This solves your "are too easy to fake" part.

Re:Not effective

[B2382F29]

If each passport had a key encrypted with a passphrase (like in PGP), and you needed the passphrase to use it,

then every Joe User would write his passphrase ON the passport.

Re:Not effective

[lachlan76]

Until some guy steals a machine and reverse-engineers it. And, odds are, if/when quantum computing becomes feasible, that will probably break it, too.

And biometric IS too easy to fake. Just look at how reliable fingerprint readers are. Also, if someone makes a replica which they use to fake your ID, you have to have that replica destroyed. And tracking down some guy with a picture/mask will be alot harder than changing your passphrase, I can tell you that.

that only your government can decode/encode

The point of a passport isn't just to be able to track who has been leaving the country, but to see who is coming into the country. Therefore, other governments will need to be able to decrypt the chip. No doubt it would get leaked somewhere along the line.

Re:Not effective

[lachlan76]

You wouldn't be any worse off, since you still need physical access to the passport to be able to read it off. And with the current system, if someone has access to the passport they can just steal it anyway.

Re:Not effective

[scum-e-bag]

Until some guy steals a machine and reverse-engineers it.

They would have to use a challenge-response system like banks use at ATMs. This would allow deployment of offsite machines that could test passports and make stealing one almost pointless.

Re:Not effective

[BJH]

So... you have some encoded data embedded in the passport. If it's encoded, there needs to be a key. If the key is in the possession of the customs officials (who presumably need to verify your identity), then it's susceptible to being stolen and abused.

Re:Not effective

[rteunissen]

Actually i find the concept to authenticate against what you are very insecure. Think for instance about a scenario where you have an equal twin, both with the same face. They could swap passports (or steal, depending on your level of paranoia) and go through customs pretending to be the other one. Make one twin criminal and the other decent and you get my point.

Re:Not effective

[RayBender]

Actually i find the concept to authenticate against what you are very insecure.

That's one problem. Another is that you can never change that authentication token, the way you can change passwords or keys. Imagine a scenario where you work at the airport and the Evil Terrorists (tm) manage to get a copy of your fingerprint (can be done with latex gel and an eraser) or retinal scan and can use it to access something important. The only secure response is to deny access to anyone with a fingerprint that looks like yours, forever. So either you never work again, or you get to have a special password system just for you (and all the other ID-theft victims). But of course, at that point primary security rests with the password system; which you miight as well just use in the first place.

Biometric security systems strike me as being very similar in spirit to the various copy-protection schemes out there that the RIAA loves; they sound intimidating and high-tech, but are really poorly thought-out and only good to keep out amateurs, while serving to make all our lives more difficult. I wonder if our security guys really do think that al-Qaida really is a bunch of amateurs? Are they?

As for biometric passports - why in Ashcrofts name would you keep the biometric information on the passport as opposed to in a central database? If your ATM card didn't rely on a central server the banks would have been cleaned out long ago. I have no doubt that professional forgers, being the third oldest profession (bureaucrat being the second, and we all know what the first is), could sooner or later figure out how to encode the biometric information. In other words, the passport has to be considered insecure and information on it shouldn't be trusted.

Now, if you don't keep the fingerprint scan on the passport, why make a big fuss about "biometric" passports? Deliberate misinformation? Or is it a two-step scheme where the retinal scan is too big to transmit, so a copy is stored on the passport and e.g. a hash on the central server to verify the integrity of the passport?

Of course, you can still hump it across the Rio Grande, biometric passport or no biometric passport. So now we have to start checking people inside the country as well as at the border. Sooner or later this road leads only one place: frequent random searches of all citizens and demands for "Your paperz, bitte" anywhere, anytime.

Re:Not effective

[dotwaffle]

Why not embed the custom officials in the passport ;) A little computer, with some AI, call is Custom Version 1.0 ;)

Re:Not effective

[Malc]

You're right. You'd think people on this site would know better. In computer terms, there's no such thing as security on the client. The client is untrustworthy. At some point the system will be hacked and then people will be able to put whatever they like in the chips in their fake passports. Of course, customs and immigration officials will trust the technology and won't believe that the thing is fake. The only way this kind of thing will fly is to keep the information in an internationally shared database. Information on the passport is then only marginally useful in offline situations. I'd like to see governments implementing that (yes, sarcasm).

Re:Not effective

[maxpublic]

You'd think people on this site would know better

No, not really. This is "news for idiots who don't have a fucking clue, but pretend they do anyway". That's what a nerd is, when all is said and done.

Slashdot proves that every day of the year.

Max

Re:Not effective

[Anonymous Coward]

So either you never work again, or you get to have a special password system just for you (and all the other ID-theft victims).

Answer: you at least become damaged goods and can never be fully trusted, promoted etc. This, along with a thousand other qualifiers such as country of birth, leads inevitably to an elite of the "trustworthy" throughout society. These folks will have access to the best jobs (don't want any terrorist-sympathizers providing my heath care thank you very much), best modes of travel (we're going to end up with people actually unable in practical terms to use airlines), and etc.

Re:Not effective

[Twylite]

You're right, its not secure. But not for the reasons you have cited.

This is a correct use of biometrics. The use here is in identification, not authentication. In addition the biometric is one factor involved in identification, the other being a physical token (the passport itself).

In this context, faking the biometric is hard (but obviously not impossible). If you steal someone's passport then you need to make your biometrics appear to be their's, i.e. change you face, your fingerprint, etc. Fooling a single scanner is not sufficient to fool the system, since you will be subject to passport checks to leave and enter different countries, and the scanner will be operated by a person (giving you extremely limited opportunity to fool it).

Why this system would appear to be grossly insecure is all the talk about encrypted traffic from the card. This requires some sort of shared secret key architecture, unless every request goes via a central repository for the particular passport issuer (in which case the passport can share a unique key with its issuer, and the issuer can send the data back to the scanner). This would have a ridiculous amount of overhead in terms of identification time and implementation effort, not to mention problems with "the system is offline".

Making this system sufficiently secure is not difficult, but requires some careful thought. The first step is to have each passport issuer sign the biometrics and publish its public certificate. Then creating a fake passport is practically impossible (although bribing an official to have one created is still relatively simply).

Solving the privacy issue is harder. You have to allow certain scanners (customs, perhaps your travel agent, bank, etc) to read the information, but not allow it to be "sucked" from your pocket on the street. The simplest solution is to keep your passport in a sleeve that retarts the contactless communication. Another is to have a shared secret key architecture, and yet another is to have an online system that requires the passport issuer as a "trusted third party". Perhaps the best solution would be to have a card with a button or pressure sensitive region so that it only communicates when pressed, preventing identification without your explicit content.

Re:Not effective

[lachlan76]

The biometric is NOT secure in this case, because it is being compared to data on the chip.

To fake it, you need only to change the data on-chip to match your own scan.

Also, biometrics in this case ARE authentication, because the identification is done by the name on the passport. The biometrics are just used to verify the identity. And how suspicious can a customs offical be about someone who has passed a biometrics scan? If you can easily fake it, it wouldn't do any damage unless it was trusted. It is this false trust that is dangerous.

Signing it with a public key algorithm is a good idea, but it only takes one official to sell the private key to a forger.

Re:Not effective

[Twylite]

Forgive me for assuming something more intelligent than a signed fingerprint.

The on-chip data should include all data visible on the passport (your name, passport number, age, etc) plus a picture and other biometrics as appropriate, all signed together.

Since a computer will be reading and logging this info, and assumedly checking it against a database of who was supposed to be on the plane, known terrorists, MP3 pirates and senators, I thought it too obvious to state that this info would be in electronic form and digitally signed.

Yes, you can load the signed data onto a different card. No, it doesn't break the system, because what is printed on the card is just there to be pretty. All real information and safeguards are electronic.

Signing it with a public key algorithm is a good idea, but it only takes one official to sell the private key to a forger

Clue: institutions that are serious about security don't store private keys where they can be retrieved. They use a device called a "Hardware Security Module" (HSM). This device will protect its contents from just about anything you can throw at it if you aren't a government; it does this by securely erasing all sensitive data without the possibility of retrieval. These devices generate the key pair and never allow the private key to be exported. Some types are insecure enough to allow the private key to be duplicated into another HSM, but only if you have a pair of trusted custodians who have to enter symmetric key components into the HSM for this purpose. The entire system is operated in a secure facility with access control systems, so that no-one without the necessary authorisation gets in to play with or steal the HSM (not that it would do them any good).

This is how security works in banks and governments. So you've heard that bank security sucks? Yes, it does. Because they don't know how to use HSMs properly, or design a secure cryptographic system. All the attacks on banks are against IT infrastructure, protocol weaknesses or are social attacks on authentication.

quickly, think of a reason,

[way2trivial]

and order a 'sample quantity' know..

they'll be needed in the years to come...

digital != greater security

[tpgp]

bringing passport documents into the digital world is sure to increase security."

Surely noone believes that do they? Why?

Digital is inherently easier to copy then analogue - I think this would decrease security.

Re:digital != greater security

[xystren]

"Getting into these chips is going to take more than your average bear. There will be MIT students who do it, but it probably won't be widespread," said Jim Handy, an analyst at Semico Research. "You will have to know how the chip is encrypted and how it is programmed."

And didn't they say somthing like this about virus, worms and trojans? Look at all the fragging scriptkiddies out there now?

Let me take care of my *own* security, and quit trying to cram other bullshit security ideas down my throat.
---
sig lines? We don't need no stinky sig lines.

Re:digital != greater security

[cfuse]

Surely noone believes that do they? Why?

It works the same way that not teaching kids about sex and drugs does. That's why we have so many sober teen virgins.

The price you pay...

[Anonymous Coward]

...if you don't want terrorists to drive airplanes into large buildings or nuclear power plants.
Security doesn't come for free. You have to invest something for getting it. No sane person would run a Windows or a Linux box on teh internet without elaborate security setup.
And in anti-terrorism this translates to getting better passports with more detailed information.
For all the people who start to whine about privacy: if there is really a problem with this then your problem is not the passport. Your problem are the goverment and companies who can't be trusted. If you vote such people into office you shouldn't whine about the privacy issues of RFID chips. You just get what you wanted.

Sorry but a don't want a 747 crashed into my home just because some fools don't reliaze where the real problem is. It's like guns: not weapons are killing people, people are doing this. Technology isn't inherently evil.

Re:The price you pay...

[tpgp]

...if you don't want terrorists to drive airplanes into large buildings

You are a retard.

The 11/9/2001 terrorists had valid passports. This system would have done nothing to prevent that attack.

Re:The price you pay...

[rokzy]

exactly, how about making the authorities show they are capable of understanding and using regular passports before they make things 10 times more complicated with RFID ones.

Re:The price you pay...

[oolon]

Do you have to even show a passport for internal flights? If other id is accepted how closely are they check for validity?

James

Re:The price you pay...

[cornjones]

Hey,
don't underestimate the bait and switch. If the current administration stays in power, do you really think it is beyond them to convince the induhviduals that this would have stopped them? The did the bait and switch very successfully w/ Iraq.

Re:The price you pay...

[vespazzari]

Security doesn't come for free. You have to invest something for getting it.

Of course we must be willing to give up privacy for security... that is a given, and I think that most people understand this. I however do not belive that this is a tradeoff I want to make. America is was known as the land of the free at one point for some reason, we are now slowly slipping into "the land of the safe".

No sane person would run a Windows or a Linux box on teh internet without elaborate security setup.

Of course they wouldn't but this is a threat that is actually there, I have seen for myself the problems with doing this... But, it is nobody but myself that chooses the security level of my box, I could make it ultra secure but then it would not be as usable. So instead I make a tradeoff between security and usability, The security measures that I have installed a transparent and they do not effect the rest of what I do.

If you vote such people into office you shouldn't whine about the privacy issues of RFID chips. You just get what you wanted.

I did not vote for Bush, and even if I had, should I just keep my mouth shut? I dont know why you think that we should just ignore the problem because, after all, we voted them in... Our country is supposed to be a free country, we are not supposed to be tracked like dogs and cows, we have a right to demand privacy.

In the end it is all about the tradeoff between privacy and security, and I for one would rather have my privacy.

Re:The price you pay...

[maxpublic]

Do you have to even show a passport for internal flights?

Soon you'll be hearing the words "your papers, please?" on a regular basis.

Max

Re:The price you pay...

[oolon]

Sadly I think your probably right, bush after all has already said how he prefers dicatorships to democracy, and he didn't even know pakisan was a dicatorship and hoped the new guy will bring stabilty!

James

Re:The price you pay...

[cfuse]

...if you don't want terrorists to drive airplanes into large buildings ...

Start by NOT teaching them how to fly planes.

paranoia

[Anonymous Coward]

A real-time facial scan of the carrier of the passport would then be matched to the data encoded in the chip. But privacy advocates such as CASPIAN are concerned that this data could get into the hands of the wrong people or that governments could use the data to track their citizens as they go about their personal business.

well, my U.S. passport has a line of characters on the bottom of the first page (y'know, the one with the picture of me on it). the characters include my name, birthdate, and passport number. everytime i've returned to the u.s. from travelling, my passport is opened to that page and run through a scanner slot. i assume they are reading these values (as far as i can tell, there is no magnetic strip on there). other countries usually just make me write down my name, address, birthdate, and passport number when i pass through customs. so, governments can already track me as i go about my personal business. as for matching the facial scan, good thing, it means that i won't have to worry about my passport being stolen and used.

Re:paranoia

[Rakshasa Taisab]

But what they cannot do is scan your passport while you are protesting against $EVIL_POWER.

Although if you have a cellphone...

Re:paranoia

[lachlan76]

I haven't tried this, but it wouldn't surprise me if there was a barcode visible under UV light.

Just because you can't see it doesn't mean it's not there.

Re:paranoia

[deimtee]

It's more likely that they are using the same magnetic ink that they use on bank cheques, and that they are reading that line of text.

Re:paranoia

[Punctuated_Equilibri]

I agree, same with my 1994-issued US passport. I wonder how many of the more excitable posters on this topic actually have a passport and use it regularly for international travel.

Seems to me the proposal is to take the personal information that is already in the passport and store it electronically so it can be read faster and more accurately when you're at the immigration counter. Don't see how it could be used to track me domestically since I toss it in a drawer when I get home.

I bet paranoia on this issue is inversely correlated to the amount of time you've spent in line waiting to go through customs -- (less travel -> more paranoia)

why rfid?

[t_allardyce]

Seriously im all for storing a picture of the person on their card if it makes general facial recognition easier but why the fuck does it need to be RFID someone please explain why a normal chip on the card would not do?

Re:why rfid?

[lachlan76]

An RFID chip doesn't need any contacts, so all the machines involved (passports, readers, etc) last longer, and you only need to hold the chip near a reader, and not line it up and touch it.

Re:why rfid?

[klingens]

Cause then you don't need to tell the cardholder "Your ID card please, citizen". You just bring an antenna in his general vicinity and check who he is. Also, normal chips with contact pads wear out over time when put into card readers, get dirty, etc. RFID doesn't have those problems

Re:why rfid?

[t_allardyce]

you are joking right? please tell me your taking the piss??!? so again, someone please seriously tell me why rfid is needed instead of a normal chip!?

Re:why rfid?

[t_allardyce]

WTF?!?! this totally insane you cant justify sticking a remotely accessible device on your passport because "contacts wear out" and "people are too dumb to stick a card in a hole" - if you cant stick something in a hole then you're not exactly prime for reproducing the species!

Re:why rfid?

[lachlan76]

There is no other reason than ease of use and lifetime, as well as reliability. RFID is immune to dust and water. You don't want your passport to stop working if it gets dusty or you get water on it.

Re:why rfid?

[lachlan76]

RFID chips don't need to be readable from that far away, some will only work from a few centimeters away, which would be enough.

people are too dumb to stick a card in a hole

Passports over here last for ten years. If you actually GO overseas a lot, then you don't want the guy at customs in whatever country to accidently break the card when it get pushed into the slot.

And if you're so smart, what do you think happens if the card gets bent?

Re:why rfid?

[t_allardyce]

so its true? this whole thing is totally insane! passports get old and expire, everything gets old! if your passport gets wet you can get another one. lets find an analogy: pilots cost money, while they wait around for the plane to refuel they are loosing the airline money. lets take all the pilots off the planes and stick them in a control centre where they remotely fly the planes. as soon as one lands they are assigned to another one. also the cockpit wastes allot of space that could be used for passengers!

Re:why rfid?

[pslam]

An RFID chip doesn't need any contacts, so all the machines involved (passports, readers, etc) last longer, and you only need to hold the chip near a reader, and not line it up and touch it.

If that were true then why is the entire of retail UK switching to the "Chip and Pin" system? It's basically a smart card reader and entry pad. I'm sure they're not incredibly long lived or reliable, but I bet the readers are cheap enough that it's not actually a problem.

In fact, I see the contactless London Underground ticket machines causing more trouble than the magnetic stripe readers. When one magstripe machine breaks, there's plenty of others to go through, or a guard who can quickly read a timestamp and wave people through. When the contactless machine breaks, there's either no other similar gate (because they're expensive), or they both break (probably needs a server link), and then you're screwed because there's no way of working out if your ticket is valid.

Re:why rfid?

[lachlan76]

Yes, all passports expire eventually.

This is not an excuse to use a less reliable method of digital ID when a more reliable one is available.

And do you WANT to have to get a new passport in the middle of a foreign country?

Re:why rfid?

[BJH]

Hey, good idea! Mind if I patent it?
Now all I need is a snappy name for the airline. "Blind as a Bat Airways"... "Meat-tube Air"... "Nintendo Airlines"... Whadda ya think?

Re:why rfid?

[BJH]

Maybe the government can just implant RFIDs in the asses of all new-born babies. It could be called "the Mark" or something. You'd sit in a special seat whenever you needed to be identified, and if the identification failed to authorise you, the handy high-voltage circuits in the chair could save officials the trouble of arresting you and holding a trial and stuff.

Re:why rfid?

[lachlan76]

Magstripes are too easy to damage with magnetic fields and such.

Also, a smart card used for shopping doesn't need the reliability that a passport that you want if it's required to enter the country. Also, The cost of RFID readers is approximately zero compared with the other things that you find at an airport (i.e. planes).

Re:why rfid?

[t_allardyce]

"RFID chips don't need to be readable from that far away, some will only work from a few centimeters away, which would be enough."

I cant believe im hearing this crap on /. security by saying your wireless product can only go x meters is _not_ security. EMF is complex and underrated and even if you cant make the range bigger, 1cm is enough to get the data, a pick-pocket in a busy place can lift your whole wallet! so imagine what someone with a small reader can do.

"Passports over here last for ten years. If you actually GO overseas a lot, then you don't want the guy at customs in whatever country to accidently break the card when it get pushed into the slot."

Lets not forget this is a dual passport, all the information is still contained on the paper. Readers can be designed to handle the whole thing - hell most card readers these days will suck the card in for you. Smart-cards have been in general use for years and theres hardly a problem with them. Magnetic strips (though they have much less storage space) have been around even longer! I stick my cards in holes everyday (heh) and they dont get screwed (hehe) i cant believe a security argument rests on some dumb customs guy bending your card.

Re:why rfid?

[t_allardyce]

this is not an excuse to use a highly insecure method of digital ID when a more secure method is availiable. fine if people want this then they can have it, but we should certainly have a choice - you can either have an RFID card or a smart card, and if your smart card breaks it was your choice. Even so its not like your using a blank passport it still contains the written information printed on the card and you could allow people to fly back home based on that, at home the customs people will sort you out with making sure you are who you say you are and getting you a new passport.

Re:why rfid?

[t_allardyce]

how about "0w3nZd Air"

Re:why rfid?

[RayBender]

how about "0w3nZd Air"

ROTFLOL!!! Mod parent up. :P

Re:why rfid?

[1u3hr]

In fact, I see the contactless London Underground ticket machines causing more trouble than the magnetic stripe readers. When one magstripe machine breaks, there's plenty of others to go through, or a guard who can quickly read a timestamp and wave people through.

In Hong Kong we've been using contactless tickets for several years on the subways. The readers can't be very expensive, as they've spread not only to buses and trams, but can also bne used at point of sale at 7-eleven shops. The magstripe ones are almost phased out, only used by a few people who prefer to buy single-ride tickets.

Note -- there is no tracking involved, the cards are anonymous and you can top them up with cash in a machine.

or they both break (probably needs a server link), and then you're screwed because there's no way of working out if your ticket is valid./i>

In HK, each station has at least one window you can ask to have a card replaced if it doesn't work, or buy a new one, or top them up. Ther are also machines you can place your card on to check it, it tells yo how much credit you have and the last transaction. Sounds like the LU has not really implemented this well.

Kidding, right?

[CleverMonkey]

Whenever I hear "with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security," I cringe. The idea that something which sounds like increased security will actually amount to increased security without any real analysis is an all too common reaction these days.

Think about the TSA (Thousands Standing Around|Take Scissors Away) - does taking knitting needles make anyone safer? The biggest change in airline safety because of 9/11 was 9/11. Before folks figured that they could just quietly land in Cuba and live on peanuts for a few days before they would be brought home. All that has changed, but it didn't require billions of dollars, air marshals, or any of the other visible crap the government did to create the illusion of security.

While biometric passports might make identification more certain, you need to fully look at who/where/how passports are used, and see if these measures will actually be useful in the real world. Urg.

Re:Kidding, right?

[Anne Thwacks]

While biometric passports might make identification more certain,

Might not ... Any reasonably competent forger will be able to download the required information into a fake passport with no more effort than making a Costco membership card.

The UK scheme is nothing to do with security, its a scam to take $100 off every man, woman and child in the country to pay for the war in Iraq.

Re:Kidding, right?

[winwar]

Heck, it could reduce security.

Why?

Currently a screener has to LOOK at the passport. They actually might have to use a few brain cells. They might find something isn't quite right and investigate further.

If the screener thinks the new passport is "secure" or the computer is always correct, they might (probably will) just let the computer think for them. The computer says the passport is valid, well, go right on through.

Biometric passports may speed up processing. Increase security, nope.

Re:Kidding, right?

[Jordy]

I'm confused about this.

If you take a picture of the person, a serial number (printed on the passport), age, country, start date, end date, etc., sign it with a government issued private key (obviously in a hierarchy so you could deal with compromised keys) and then make the public key available to anyone who wants to verify the data, exactly how is a forger going to do anything with it?

The only thing people will be able to do is try to go through the legal methods of getting a passport using an assumed name or attempt to crack the private key used to sign the data. Since cracking the private key is rather infeasible, that leaves trying to get a passport under an assumed name.

"with all of the terrorist threats lately"

[AC-x]

How the hell will this protect us from terrorism? I'm sick and tired of our governments trying to implement 1984 under our noses in the name of security.

For example, I'm sure no-one would notice if a farmer bought a load of fertilizer and diesel fuel, and no one would notice if he drove a van into the centre of some large city, but that's all he'd need to do to blow up a lot of people.

The only way we can truly protect ourselves is to quite literally monitor everyone's actions 24-7, but if that were the case I'd rather live in North Korea.

Re:"with all of the terrorist threats lately"

[zors]

Well, to get the amount of fertilizer necessary to make this sort of bomb, i believe there is someone whose job it is to notice. Isn't the FBI supposed to check out farming operations that require a certain amount of this type of fertilizer?

Re:"with all of the terrorist threats lately"

[pVoid]

Someone buying a large quantity of fertilizer could tip off the FBI. But that's aside the point:

A very important fact that seems to be overlooked all the time is that most of the terrorists have *legit* passports. So what good is it if they have RFID tags in them?

I just am waiting for the day that you will be able to disable RFID using only EM based tools, so there is no apparent physical tampering, but the RFID device stops working... kinda like when they swipe merchandise on that powerful magnet so you can walk out the store without setting off the alarm.

Re:"with all of the terrorist threats lately"

[kfg]

The only way we can truly protect ourselves is to quite literally monitor everyone's actions 24-7

Which is why if you want yourself protected the first thing you do is have yourself sent to prison.

KFG

Re:"with all of the terrorist threats lately"

[mindstrm]

Huh?

A typical farmer would by TONS more than McVeigh used in Oklohoma. That's the point.

Building a bomb, especially if size isn't too much of a consideration, is EASY. There are many, many ways to do it.

Further, it doesn't take a large bomb to make terrorism work.. someone tossing sticks of dynamite (easily available all over the world) into nightclubs would get people worked up just about as well. The whole point of terrorism is that it's cheap... a single event and a few deaths is so spectacular that everyone forgets to put it in scale. More people died in car accidents in the US last year than did on Sept. 11th, but the US isn't throwing billions into auto safety or cars that self-drive. More people died from smoking-related disease, but you don't see the government outlawing tobacco.

Re:"with all of the terrorist threats lately"

[zors]

Thats true. For some reason i was thinking only along the lines of a massive truck bomb using that specific type of fertilizer to destroy a whole building or something. Too early to be smart, i guess.

Hey, it sounded airtight and insightful in my head. Until now.

Re:"with all of the terrorist threats lately"

[YrWrstNtmr]

More people died in car accidents in the US last year than did on Sept. 11th

Make that last month.

Re:"with all of the terrorist threats lately"

[PsiPsiStar]

While I understand what you're saying, there are a few key differences;

1. The government does have a lot of cops out on the road giving a lot of tickets, vehicle citations, etc. They've invested in road signs and all kinds of ads against drunk driving, speeding, liscensing, etc. I'm not sure that self-driving cars would really reduce accidents, especially given our current technology and the public resistance to public transit is too great. They haven't created airplanes that 'self-fly' yet either.

2. Deaths from auto accidents don't have political relevance. There's a distinct difference between people involved in accidents and people making political threats. It's not just about relative body count. The government has a much greater responsibility to protect us from criminals and foreign threats than it does from accidents.

3. If you had 2000 auto accidents in NYC, in one day, you'd probably get a much bigger reaction, psychologically than if they were spread out across the US. Events, particularly events beyond people's control, make a bigger impact than things people think they might be able to control. It's not just that people died on 9-11 but that there was no way for the individuals involved to prevent their deaths. And that's a strong psychological need, to be in control. So there's a greater desire for government action.

Individuals who are worried about dying from smoking or driving accidents can take actions that they believe will defend themselves.

Re:"with all of the terrorist threats lately"

[geekee]

All the 9/11 hijackers entered the US using falsified passports and you see no need to improve the system and conjure up some irrational fear based on a book written against an etirely different threat to justify yourself? Emigrate to north Korea and find out what they authro of 1984 was really talking about

Re:"with all of the terrorist threats lately"

[Anonymous Coward]

Except they didn't. They all had valid passports in their own names. Almost all Saudi passports, I think none were Iraqi and none were Afghani.

Re:"with all of the terrorist threats lately"

[geekee]

Even more reason to improve screening.

Sure?

[Anonymous Coward]

"But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security."

Sure?

Re:Sure?

[golgotha007]

one thing that's sure by implenting this:

another little piece of America's dwindling freedom and privacy is chipped away.

chip...chip...chip

This may decrease security...

[Homology]

But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security.

Why should that increase security? Perhaps there will be even more opportunities for forgeries. From Bruce Schneier' Crypto-Gram

There's one other problem with identity documents: the ease of getting legitimate documents in fraudulent names. Several of the 9/11 terrorists obtained fraudulent IDs from the Virginia Department of Motor Vehicles by paying a corrupt employee $1000 each. These weren't fake IDs. These were real IDs in fake names, with all the holograms and micro printing and whatever else the driver's licenses have to make them hard to forge.

Re:This may decrease security...

[Overzeetop]

Actually, it makes things less secure, because the training courses will emphasize that these "unbreakable" cards will give nearly perfect results. A good forgery will be even less likely to be questioned.

Most of the cr@p instituted falls under the "keeping honest people honest" area of security.

Re:This may decrease security...

[Anonymous Coward]

Hey, let's not California which wants to allow illegal undocumented workers, who by definition are not properly identified, in the state to get "valid" drivers licenses. If a document is going to be used for identification purposes you damn well better be sure that the processes used to obtain are as foolproof as possible. Otherwise, all you are doing is putting your faith in a fraud and that is an even greater risk.

Re:This may decrease security...

[pilsner.urquell]

But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security."

But who is going to secure the securer? Who is going to secure the originator of the documents and who is going secure the originators boss and the boss' boss? Who is going to write the encryption codes and secure that person and that persons boss and that persons boss?

Also, who is going to be accountable in event of a screw up? Should a digital documented contain a log starting with the originator of the document and listing all persons having access to that document? Should the owner of the document have access to any or all of the information to a digital document? In the USA is there a Constitutional Amendment concerning digital documents on the horizon?

False dilemma

[Kris_J]

Prove first that these new technologies will in fact increase security and then I'll argue the privacy case.

Re:False dilemma

[maximilln]

Prove first that these new technologies will in fact increase security and then I'll argue the privacy case.

A very good distinction. The way this is done, however, is they make a case that these things might increase security and then they spend taxpayer dollars implementing it. If there is no increase in security in five years the claim is made that the system hasn't been adequately refined. If there is no increase in security in ten years the results are used to justify spending more taxpayer money on a newer scheme.

It sounds like profit all around except for the taxpayer.

Re:False dilemma

[Confused]

You can see it also the other way round.

Today all passport have pictures in them, and most are machine readable. At most borders, the passports will be read by a scanner anyway. If the scanner scans the picture or reads the encoded picture from another place makes no difference for privacy and there's no need to panic.

The big privacy concern is what data is associated in the databases with your passport number - which is easy to scan even today.

The whole RFID-craze seems just to be scam by the chip vendors to peddle their wares.

I disagree

[savagedome]

But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security

First of all, and as 300 other comments would be pointing out by now, all those bastards on 9/11 planes had valid passports too. Whether passport is valid or not doesn't prove nothing.

Plus, IMHO, its harder to forge a non-digital passport. Thats a real skill. You can't walk into Radioshack, buy $70 worth of equipment, come back home and start playing with the RFIDs on the passport if its digital and all.

If its a non-digital passport, sure as hell if you indeed plan on forging/tampering it, you will have to find someone highly skilled that can accomplish that. And, if its a bad forgery job, its very easy for a human being to spot that.

My 0.02

Re:I disagree

[t_allardyce]

true with anything digital theres always the potential that you can create an exact copy so perfect that there simply is no way to tell the difference, a 1 is a 1 and a 0 is a 0. With anything else theres always tons of evidence, everything form minute bits of DNA, finger-prints, the wrong type of paper/card/ink or the exact same chemical makup thats in a batch that was reported stolen from somewhere. Even lazer printers have been prooven to show minute defects from the drum that can be used to identify a particular printer. Sure all this evidence will stop when people finally find ways around it but untill then the physical world just cant be forged like the digital world.

Re:I disagree

[denthijs]

Plus, IMHO, its harder to forge a non-digital passport. Thats a real skill. You can't walk into Radioshack, buy $70 worth of equipment, come back home and start playing with the RFIDs on the passport if its digital and all.

This is a typical techie answer, but i know some people who work in printing that will have opposite views on this.
Every technology can be hacked.

Re:I disagree

[mdfst13]

This is even worse. The whole point of RFID is that it works over distance. Thus, you can walk around the airport and *collect* passports. At least with a paper passport, you have to actually get physical posession of the passport to forge it.

This is the Microsoft Windows of passport systems: easy to use for both users and crackers.

Re:I disagree

[1u3hr]

>Plus, IMHO, its harder to forge a non-digital passport. Thats a real skill. You can't walk into Radioshack, buy $70 worth of equipment, come back home and start playing with the RFIDs on the passport if its digital and all.
This is a typical techie answer, but i know some people who work in printing that will have opposite views on this. Every technology can be hacked.

The difference is that when a digital technology is cracked, it takes no time at all before the method is known by all the black hats, who can all spend their $70 and start forging passports immediately. Doing the same in printing requires a lot of skill and experience, and access to special papers, inks and presses. (Digital printing won't fool anyone with a smudgin of training.)

Re:I disagree

[josecanuc]

Every time RFID comes up on Slashdot someone brings up that it can be read over a distance. Do not forget that there are many forms of RFID and that there are some that will not give up their information until they recieve the right unlocking key.

Not 100% secure, but the same type of authentication that CRAM-MD5 uses, which is trusted by many email servers and corporate remote authentication devices.

Don't assume that the type of RFID used will be chosen by techno-dolts who look only at price tag. There are knowledgeable folks out there doing the actual implementations.

Unspecified threats

[BillsPetMonkey]

"But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security"

Has the lack of digital passports ever facilitated a breach of security? You know that the 9/11 hijackers had valid US passports. If they had digital RFID passports on them instead would they somehow have thought twice about hijacking the plane?

It's dorks like you who will eventually get CCTV into people's houses with the apologist "hey if you've got nothing to hide ... "

Linux

[Alosja]

Will my passport run linux? There must be a way :)

Re:Linux

[enigmathegreat]

Imagine a beowulf cluster of these...

Err, not exactly

[Etyenne]

But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security.

Thanks for the wishful thinking, but "bringing passport documents into the digital world" (whatever that mean) is not exactly a silver bullet for security.

What terrorist threats?

[Anonymous Coward]

The post implies that with all "the recent terrorist threats" this is in some way a good thing.

There hasn't been a terrorist attack in any of those countries for some time now - certainly not an attack of any form. Can somebody please tell me what evidence of threats we have despite that which is given to us by the same people who lied about WMD in Iraq?

The terrorism is happening in countries that will not be aided by the countries listed in the article putting RFID tags into passports. It's just another excuse to have another civil liberty stripped from you. Don't accept it.

Re:What terrorist threats?

[tonyr60]

"There hasn't been a terrorist attack in any of those countries for some time now"

The country under threat is the US, and it is the US that is requiring these security "enhancements". If NZ, Aus etc. do not upgrade their passports, the US will revoke the visa waiver provisions to their citizens.

make sure EVERYONE can read the chips

[Anonymous Coward]

Not just Government officials. My security is NOT increased by a powerful elite having information about me while I don't have information about them. Surveillance technology is probably unavoidable. But if implemented in the "Free World" (or the West), it should be Public Access, so that any citizen can keep tabs on anyone. Recognise that that most schemes that the government proposes do NOT follow this principle, as they are really seeking additional power over the populace, not seeking to help security.

Preserve the balance of power: require all surveillance systems to be public-access.

see if you can find.....

[Anonymous Coward]

...anyplace on the web, any photograph of the planes that hit WTC 1 and 2 where you can see passenger windows. I'd like to see it. All the pics and video clips I have seen show cargo planes.

Re:see if you can find.....

[denthijs]

also, some pictures of actual plane debris in the pentagon crash,..
How come people don't notice the HUGE gaps in believability in both crashes still baffles me
--
disclaimer: conspiracy fetishist

Re:see if you can find.....

[Anonymous Coward]

They don't want to see it because it would require an entire top to bottom regime change domestically, maybe all the way to massive civil war. It's easier to go with the crowd and believe the big lie. And it's primarily the medias fault, because they refuse to do anything that would tend to destroy their own influence and position and wealth and power in our society. At the top they are well aware that 9-11 was a huge congame, but they also are massively profiting from it, and any true honest "big media name" reporters will find themselves out of a job or in a "tragic accident" should they push for some truth. This has got to be one of the planets most important issues ever, and we are supposedly in the information age, and the information is actually out there, but few people seem to be noticing it. Kinda sad in a way, just shows how gullible and...I don't know, just how brainwashed and set in their ways people can get.

Re:see if you can find.....

[Anonymous Coward]

Even better, one of the few non-military related eyewitnesses to the Pentagon crash says he saw a "small plane, perhaps capable of holding 6-8 people, fly past about 20 feet off the ground" before it crashed into the Pentagon.

Yet the official reports talk of a full-sized airliner, even though I have to see a single photograph from the day of the crash that shows any evidence of something of that size being the cause of the impact.

Re:see if you can find.....

[Anonymous Coward]

Seems like it would be easy enough to load up the penetrator package from an agm-158 (or a tomahawk or whatever) into a small business size jet, then use predator/global hawk remote control electronics and build a nice civilian airplane looking stealth cruise missile. Heck, just an agm 158 LOOKS like a small plane if you saw it going by fast.

I do remember from the day of the attack all the first reports said it was a truck bomb though, then they changed their story. So who knows, sure bet though it wasn't some huge airliner with fuel in the wings, because there's no exterior evidence of fire all over the grounds, which would have happened with an airliner and the wings being pulverised against that hard granite. That grass is more or less pristine in all the pictures, and it would have been a burnt up mess. And yes, no big pile of wreckage, like you get with every other airliner crash into anything before.

Re:see if you can find.....

[Anonymous Coward]

also, some pictures of actual plane debris in the pentagon crash,.. How come people don't notice the HUGE gaps in believability in both crashes still baffles me

Explain, please.

Re:see if you can find.....

[Anonymous Coward]

In the pictures of the plane that hit the pentagon, .. where is the plane?
normally a plane doesn't hit a building and not let various pieces of aforementioned plane about
the pentagon crash looks more like it has been shot at with a missile then hit by a plane

Re:see if you can find.....

[NuclearDog]

It seems you believe very strongly that 9/11 was all an elaborate hoax, as do I, so I figure if you haven't already read this, you might be interested in it.

http://www.public-action.com/911/jmcm/physics_1.ht ml

ND

Re:see if you can find.....

[NuclearDog]

Also, if anyone is interested, I have a rant by George Carlin on Airport Security (Be nice to my server :) ).

You'll hear the audience laugh but I find some of what he says quite chilling, as it is all true.

ND

Why not ...

[Anonymous Coward]

"... are currently looking into adding RFID chips to citizens' passports."

Hell, why not add RFID chips into the citizens?

Re:Why not ...

[Overzeetop]

Because we're not scared enough...yet. As things ratchet up in the loss of freedoms, we will feel "safer." Each "event" will scare us to agreeing to the next level.

For small losses of freedom, a simple raising of the terror alert level to red (or violet, or puce, or whatever the top is) will suffice. But to start chipping people, it'll probably require another attack (and that attack will come). It may also take the form of "convienience" - if you get chipped, you can walk right onto the plane. Then it will be come an "inconvienience" - if you're one fo the few not chipped its, "please step aside for a body cavity search."

The oceans fill up one raindrop at a time.

Re:Why not ...

[ScrewMaster]

Incrementalism, my friend. The bane of all civilized societies. If you know someone very old, ask them about the personal liberties that they enjoyed in their youth, but that were taken from the rest of us so slowly that we didn't even notice.

Oh, yeah, right...

[Anonymous Coward]

"But, with all of the terrorist threats lately"

Uhm.. yeah... well, yeah.. Yeah there are terrorist treaths, but it's all being a LITTLE bit exaggerated.
Fear makes people scared, scared people want to feel safe and secure, so scared people are more likely to let '1984'-like laws pass than not scared people and since Bush already said he'd like a dictatorship alot better..

oh, and did I mention that America passed a law that allowed the government(read Bush) can delay election day if there is a terrorist attack in the U.S. between today and the sheduled election day.

Now, doesn't that reek of something?

Re:Oh, yeah, right...

[zors]

Troll troll troll.

The federal election committee, designed to help states with elections supposedly to prevent another florida debacle, asked the justice department whether or not they can delay an election during a terrorist attack. On 9/11 there was some sort of an election in NYC, a mayoral primary or something, not sure, but after the attacks they were cancelled. OF course this is unconstitutional because elections have always been state matters. I'm not sure how well intentioned the question was, or how high it goes in the administration, but there were no laws passed.

It's too late now

[WildBeast]

Privacy is on it's way out.

Re:It's too late now

[Anonymous Coward]

1948 to 1984, R.I.P.

You can't *increase* security

[DrSkwid]

Only reduce insecurity

This is insane

[t_allardyce]

Ok ive RTFA and it doesn't explain anywhere why these things need RFID. There's absolutely no reason for it! Sticking all this information on standard 'smart-cards' would be just as effective (well i don't know how effective or what its really supposed to do anyway but it would produce the same effect). In the article it just says these are designed to only operate up to 10cm (we all know what that means) but 10cm is still enough for someone to scan your back pocket! The only possible argument is that the contacts on chips wear out and people are too lazy to stick their cards in a reader! That's not an argument. So the only thing we can conclude is:

the people in charge of this are:
a) totally stupid
b) totally ignorant
c) getting a buy 1bn get 1bn free deal on RFID
d) designing this so they can scan people without their knowledge

take your pick.

Re:This is insane

[CanadianCrackPot]

So now instead of a tinfoil hat I need a tinfoil passport holder...

Re:This is insane

[Anne Thwacks]

designing this so they can scan people without their knowledge

Thats SCAM not SCAN. The idea is that the public have to pay for this sh*te - its another of Tony Blair's stealth taxes.

"with or witout"

[Anonymous Coward]

"But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security."

You mean, without terrorist threats it wouldn't be an increase in security?

In additon, what exactly makes you think that this will "increase security"? Has security been defined? Can we measure it? Before and after introducing these passports?

Cheers!

Not flaming, not trolling: simply another argument

[Sapphon]

I'm sure no-one would notice if a farmer bought a load of fertilizer and diesel fuel, and no one would notice if he drove a van into the centre of some large city, but that's all he'd need to do to blow up a lot of people.

Sure, but people don't just go and do that kind of thing without any prior planning. The intent has to be there first, manifesting itself in deviations from regular patterns of activity and other abnormalities in the lead-up to the act. Abnormalities which the government relies upon noticing, because tracking everyone 24/7 is impossible even for them.
Anyway, increased tracking capabilities just makes the task of picking up irregularities simpler, because they have more data to work with. More data = better predictions

/Devil's Advocate

Only one thing you need to know

[SmallFurryCreature]

The 9/11 terrorists had perfectly legal passports. So they wouldn't have been stopped no matter how good the biometrics. The various terrorist organisations got plenty of members who spend enough time in the west to get legal papers. They really don't need to bother with forgeries.

This isn't about the war on terrorism or even "regular" crime. It is about the war on illegal papers as used in illegal immigration.

Another point is that many european countries are getting closer and closer to introducing mandatory ID to be carried at all times. Add RFID tags and the next easy step will be to add RFID receivers everywhere to track every person.

What, current law would prohibit it? So? This is europe, home of the holocaust. It is not what use tracking everyone will have now. It is what it will be used for 20 yrs from now.

Re:Only one thing you need to know

[t_allardyce]

Use normal smart-cards instead of RFID and the whole tracking problem disappears, so far no-one has been able to reasonably explain why RFID is used, sure you could have mandatory card readers everywhere to get into buildings etc but atleast people would be more aware of it if they had to actually get their card out. Are the people really going to just accept the government saying "were using RFID because smart cards wear out."

Re:Only one thing you need to know

[Anonymous Coward]

Another point is that many european countries are getting closer and closer to introducing mandatory ID to be carried at all times.

Not too bright, are you? Is is already mandatory in many european countries to carry ID with you at all times.

Re:Only one thing you need to know

[optimus2861]

It is already mandatory in many european countries to carry ID with you at all times.

That includes Spain. Any government that wants to go ahead with introducing mandatory ID on "security" grounds should ask them if it did any good stopping that train bombing this spring.

Re:Only one thing you need to know

[cfuse]

This is europe, home of the holocaust.

Just goes to show that there is no such thing as an original idea.

Why is this either/or ?

[imsmith]

Is it necessarily a foregone conclusion that privacy and security are in opposition to one another? I'll grant that privacy and sloppy security are opposed, but why have sloppy security at all?

It seems to me that we (anyone who is the subject of either privacy or security) should be expecting BOTH, not accepting the proposition that the privacy-security issue (or the liberty-security issue) is a zero-sum equation.

Yes, in the U.S. the current politics seem to indicate that 'They' don't care, but what I'm really saying is, even if the government doesn't care, shouldn't the governed?

At the risk of sounding like a zealot, semantics matter and when we speak of privacy and liberty being 'traded' for security, we are tacitly conceding that we can do without either if we are scared enough. I personally want more liberty and privacy when I'm scared, not less.

Just a thought to the writers of headlines and story titles.

Re:Why is this either/or ?

[Anonymous Coward]

Have you read "The Transparent Society" by David Brin? You might enjoy it. Chapter one, which is enough for you to get the general idea of the problem of privacy versus. security, is online.

http://www.davidbrin.com/tschp1.html

Basically, the problem is asymmetries in information availability. Surveillance networks, if implemented, should be public-access, to avoid the creation of dangerous elites. Note that this Brin takes it that the surveillance networks are going to be implemented (he is NOT advocating charging headlong into implementing them!), and is aksing how can we best preserve freedom in their presence.

Re:Why is this either/or ?

[maximilln]

why have sloppy security at all?

Once the proper allowances are made for acceptable losses sloppy security is much more profitable.

shouldn't the governed?

This leads only to frustration. In a true democracy the ultimate authority rests in the hands of the people. In today's mock-up the people have no real voice at all when it comes to budget and contract decisions.

I personally want more liberty and privacy

I agree and the only reason I can think of for things to run as they do is: That's why this isn't heaven.

Re:Why is this either/or ?

[tom's a-cold]

Is it necessarily a foregone conclusion that privacy and security are in opposition to one another? I'll grant that privacy and sloppy security are opposed, but why have sloppy security at all?

It is indeed a false dichotomy. The things that are really opposed are phony security and justice. Here's why: all these security schemes can be thought of as statistical testing protocols (systems that yield 1=Al Qaeda, 0=John Q Public). To make matters worse, the ones proposed by the Bush junta are incompetently designed. They have the properties of bad statistical tests: poor sensitivity and a high false-positive rate. The high false positive rate means that very large numbers of innocent people will be falsely accused. Since this government is opposed on principle to due process, a large proportion of these people will as a consequence be falsely charged, imprisoned, or subjected to other forms of harassment with no recourse. And all this for a system that yields little or no additional security.

The real security is in having a political system that we all have a stake in, and that we're all willing to defend. Since the present system is (at best) only interested in our well-being in the same way that ranchers are interested in the well-being of their livestock, the only "security" solutions we've seen have been imposed from the top down. That makes it look like a lot like the Iraq war: a highly committed faction wants it in order to serve their own agenda, so it is then proposed as a "solution" to any number of problems that, logically, have nothing to do with it. Eventually, to be seen to be "doing something," the idiots in Congress allow it to be implemented, and catastrophe follows.

If they can't measure you, they can't manage you. With the most likely outcome of closer management being more comprehensive exploitation, the best strategy is to strongly resist any attempts to further track or monitor us.

Even if (despite all evidence) the Bush regime has no nefarious plans, putting such a system in place creates an opportunity for future abuse. Experience of politics in the US shows that the main deterrent to such abuse is lack of opportunity, not moral inhibitions or the successful application of the supposed checks and balances of a rotten system.

What "terrorist" threats?

[Anonymous Coward]

You mean the ones based upon ancient and/or falsified information, much of it obtained under TORTURE by the U.S. Military?

The "war on terrr" has only three purposes:

1. To make key members of the US govt. richer
2. To control citizens every move
3. To realise biblical prophecy by igniting a "clash of civilisations" between east and west, ultimately resulting in the Zionists dream of "greater israel", leading the way for armageddon. The palestinians and a billion and a half arabs are standing in the way of this.

That last bit might sound a bit far-fetched, but ask any fundamentalist christian zionist - for example one of the ones that have successflly brought about a coup in the U.S government.

Now - you're not going to like any of these reasons - which is just why the govt want your biometric information on a national database so dissenters may be traced whereever they are.

In order to do this, they have to scare you witless. This is what the endless "war on terror" is here for. The "terrorists" don't wear robes or turbans. They wear stars and stripes tie pins and appear on FOX news.

Re:What "terrorist" threats?

[YrWrstNtmr]

You mean the ones based upon ancient and/or falsified information,

Ancient, like that years old surveillance found on a laptop? If the FBI or CIA had obtained a similar laptop in summer 2001, showing detailed recon of the WTC from 1996, should that have been blown off as 'ancient'?

Falsified? Like explosives found on a rail line in France? Like a train station in Spain being blown up? Like capturing a Filipino national, and threatening to behead him if their government does not accede to their demands? Like explosives found in London? Like two bars in Bali being blown up?

I don't agree with many of the methods being used, but unfortunately, not all this is 'falsified'.

Re:What "terrorist" threats?

[maximilln]

Falsified? Like explosives found on a rail line in France? Like a train station in Spain being blown up?

Spare us the drama. In the order of world events these happen on a yearly basis. We're not doing any better, nor any worse, for having spent $80 billion to launch a war against this sort of thing. The only thing that $80 billion has done was increase the debt to the Federal Reserve, ensuring that we taxpayers are eternally screwed, and lined the pockets of those who are closest to the federal trough.

Like capturing a Filipino national, and threatening to behead him if their government does not accede to their demands?

Again, spare us the drama. The US declared war. It's war! Must we whine about how the enemy isn't being very polite in a war? Do they expect the enemy combatants to surrender immediately? If the US didn't want to see this sort of thing happen they shouldn't have started a war.

Like explosives found in London?

Oh the horror.

Like two bars in Bali being blown up?

There was a bar blown up in New Jersey too. Turns out that was just some fancy pyrotechnics. The point is that this sort of thing happens with a rather predictable yearly occurence.

The sun rises every day. It's not a sign.
The leaves fall off the trees every year. It's not a sign.
People die, some less happily than others. It's not a sign.

The war on terror is a money-moving front. Nothing more, nothing less. There has been no significant increase or decrease in the regularity with which world travesties occur because of it. We won't talk about the sudden increase in the severity of US initiated world travesties. Even assume that bin Laden was the perpetrator. What's the score? Bin Laden has 2 buildings and 2500 lives. The US has leveled two entire nations and cost {classified} number of lives. I think they report the number as less than a dozen if you want to believe it.

Politicians are unlike any job in the nation: they never have to set goals. All they do is allocate your money to someone else. There is no accountability, at all, anywhere.

Re:What "terrorist" threats?

[Anonymous Coward]

The "explosives" in London were nitrate fertiliser. The people arrested were very quietly let go after police had no evidence to charge them with.

That, unless im chronologically mistaken, was also the same arrest that caused the right-wing (or pro war-on-terror) press to claim that the miscreants were intending to blow up the U.K's major football stadium.

The evidence?

Some ticket stubs from said stadium, and some photographs of it.

Our (U.S and U.K) governments are deliberately letting things like this happen in order to whip up hysteria, so people will just lie back and accept things when they no longer become free citizens and the two governments open up a new war front on their next target (iran or syria).

Do you think that if that "terrorist" had had some supermarket receipts in his flat the press wwould have said the next day he was planning to blow up his nearest Sainsburys? No. i dont think so.

As for the "surveilance" information - i probably have enough "surveillance" to convict MYSELF of terrorism, having looked at a few cryptome "eyeball" series recently.

Why else do you think the "evidence" we arrest/convict people on is secret? even to the arest-ees and their legal teams?

The answer is that there is NO evidence. It's all for show.

Move along, Citizen! before i confiscate your papers!

Re:What "terrorist" threats?

[Q Who]

To realise biblical prophecy by igniting a "clash of civilisations" between east and west, ultimately resulting in the Zionists dream of "greater israel", leading the way for armageddon. The palestinians and a billion and a half arabs are standing in the way of this.

I just love Slashdot... Hordes of morons moderating other morons.

Re:What "terrorist" threats?

[Anonymous Coward]

You may find that the neoconservatives have been saying they must stop the clash of civilisations during which time they appear to be doing everything within their power to ensure it actually happens.

evangelical christians and jewish zionists (i.e. Bush's power base) REALLY DO beleive that when the chosen people return to israel, the rapture will occur. Arab "occupation" of israel is prohibiting this so they are dealing with it by wiping them out. Obviously in these days, instant genocide is not an option so there are letting the genocide last a few decades in the vain hope that nobody will notice.

U.S foreign policy seems to be quite in line with this prophecy from where im standing.

Re:What "terrorist" threats?

[Q Who]

I would write a long reply, but I'm too busy wiping the Arab occupation in my neighborhood.

I also have the weekly meeting in the judeo-mason cell in the morning, during which we are going to plan how to torture Palestinian children during the Rosh-haShanah holiday, so that proper entertainment will be available to us zionists.

But thanks for the information, I will pass it to my leaders.

Re:What "terrorist" threats?

[Anarcho-Goth]

um..... I don't think the AC was implying an International Jewish Conspiracy. Take a look at what AC wrote:

That last bit might sound a bit far-fetched, but ask any fundamentalist christian zionist - for example one of the ones that have successflly brought about a coup in the U.S government.

Haven't you ever watched the 700 Club or other fundamentalist "christian" television program?

I have and they often express what I think is cynical support for Israel.

They don't connect it with that support, but they also express a belief in the apocalypse and the rapture and they think it is a good thing.

I believe that some people have such devotion to this that they would willingly support someone they believe to be the anti-christ in order to bring about the apocalypse. You don't need to have a real apocalypse in this situation, just a self-fulfilling prophecy.

But what do I know?
I think John Kerry is the Anti-Christ and I don't even believe in the Anti-Christ.

Re:What "terrorist" threats?

[Q Who]

Dude, not to shock you with some perspective, but have you ever listened to any muslim preacher?

"Sure to increase security"

[Gothmolly]

Yeah, right... so any Russian hacker or spotty-faced teenager can crank out fake passports in his garage. How long before the government's über-ROT26 encoding scheme is cracked? Once more, we'll end up with rules that penalize the law-abiding, while providing no protection against the criminal. Normal people will have to go through the annoyance WHEN, not if, the RFID tag in their passport fails, or is misread, and they are taken for Osama bin Laden, or Teddy Kennedy.
Or wait, was this -1, Sarcastic?

Re:"Sure to increase security"

[t_allardyce]

I think it will provide a good income to pick-pockets, gangs will get together with rfid scanners walking around airports reading peoples cards and selling the data for a big proffit. They wont even need to touch you! and think of all the places they could get you - stick a reader under a chair in a cafe or waiting area and just reap in all the data you get, taxi-drivers in dodgy places want to earn some extra? let the local mob fit your car out with readers in the seats. RFID readers will be hacked and will be availiable to the public or atleast criminals and whats more they will be getting allot smaller and cheaper. People are already corrupt and even if you can guarentee customs/police/id-makers are straight in your own country you cant guarentee it in other countries using barcode encryption might work for a while but what happens when a real reader is comprimised?

Re:"Sure to increase security"

[BCW2]

I don't think that is sacastic at all. These things will get hacked & cracked very fast. There are too many countries catering to the terrorists that have supercomputers for it not to get done. The right sized bribe can buy anything. The UN oil for food scandal proves that.

Encryption and visibility

[kiniry]

Note that only the U.S. is advocating that digital passports contain unencrypted data about their owners that can be read from a distance. All other countries are supporting the idea that owner's data is encrypted on the passport by a key encoded in a barcode on the password, thus can only be accessed physically by a customs official.

Re:Encryption and visibility

[t_allardyce]

Wow this is the only post thats even come close to explaining the insane idea of using RFID where smart-cards would do. thanks. Even so it doesnt stop tracking by anyone who knows the key, and any reader thats scanned your card could potentially give away the key, either to the government (tin-foil time) or someone else. personally i still think RFID is a stupid idea and if they really want to go digital, smart cards are the way to go, even if it does mean replacing the card when it wears out.

Re:Encryption and visibility

[Anonymous Coward]

And who's to say that ONLY an appropriate (what "appropriate" means is the subject for a completely separate line of questioning) government official will be able to read this? Are we going to believe that the same government workers who will sell perfectly "valid" ID for a few bucks won't sell out the readers and codes too?

Encryption buys you NOTHING without a process to back it up. Better to just leave it in the clear so at least the holder will know what's contained.

Moderate Article?

[Potor]

But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security

Surely, this is a non-analytic proposition. And as such, an argument must be made. It is not evident that security will be increased. What is evident, however, as many people have pointed out, is that the volume of data-bases containing personal data will be increased. Nothing more.

Responsible editorial.

[mindstrm]

Are there really more terrorist threats lately, or is that just what you tend to see in the news?

My passport is one of the most important documents I carry. I need it to travel anywhere. I need it even to fly back to Canada. I need it to open a bank account, and it has more than just a record of travel.. it has residency permits and visas and whatnot.

Now... the thing is, A passport takes a lot of abuse. They go through the wash. They get sat on, run over, etc. IN the end, a passport is a picture ID with a book attached to it to record information.

Adding technology to a passport seems like asking for trouble.. though it would be convenient at the airpot for a customs agent... they spend more time filling out forms and analyzing paperwork you have filled out than they do looking at your passport.

People are still better at facial recognition than machines.. let's remember that.

i don't care about this,

[Anonymous Coward]

but then again, i live in belgium. i'm not too worried about my govment (which is what now? socialists catholics and liberals?) taking away my privacy...

also, as i was explained, my ID would hold a processor (which is probably what's meant with RFID, i didn't RTFA) to decrease the chances of it being tampered with.

then again, you can have all the measures in the world to increase security, all it takes in one corrupt clerk.

Parallels with digital vs. analog music copying?

[Anonymous Coward]

I find it amazing that the 'people' in charge seem to have such a great understanding of why digital music makes it a lot easier to copy, yet seem to think that digital passports will therefore be harder than analogue ones.

Isn't the whole point of digital music that you can make 1:1 perfect copies which makes it so dangerous (to the RIAA)? Well, with digital passports, isn't it therefore easier (encryption nonwithstanding) to make 1:1 copies too?

Of course, in some ways the whole arguement is moot because everyone knows that most terrorists will be able to use legitimate identification whether it be digital or not so it won't protect us. Furthermore, there is always the human factor. Terrorists could just contact their extremist Muslim friend who has gotten a job at whatever place issues these things and he will happily fulfill his 'duty' to Allah.

facial recognition tech isn't very good

[raindrop#1]

Before we think that this is a panacea for our security worriess we should be aware that facial recognition technology isn't all that good. In ideal conditions, with a relatively small database of images, it works reasonably well. But as soon as you put it in a real world environment (an airport for example) the reliability goes way down.

Once this is rolled out on passports, how many false negatives are they going to be getting? To my eyes, my own passport photograph doesn't look all that much like me. God knows what a computer would make of it.

Essentially this is a way for Gov't to waste lots and lots of money without adding to security. If that's all they want to do, they should give the money to me - I'll waste it for them, no problem.

No problem for me

[Maljin Jolt]

Unless these stupid RFIDs become scalar technology, simply using wallets made of conductive plastic would be sufficient for privacy.

Well, my grandfather carried a silver cigarette case everywhere for decades. For me it's stylish and geeky to put some CF cards in it, but putting all RFID money/id stuff in it will be more appropriate in darker times.

Re:No problem for me

[Anonymous Coward]

Doesn't a faraday cage need to be earthed?

I have two questions for the submitter

[Tim C]

1) How is this sure to increase security? Known terrorists are hardly the problem now; implementing this won't help against the known ones, and the unknown ones, well, they're unknown...

2) What do you mean, "lately"? Some of us have been living with the possibility of a terrorist attack all our lives.

Tracking us???

[jmcmunn]

Let's be realistic, they could be tracking us without any stupid RFID tags...you do have to show about 5 types if identification when entering the airport, buying the ticket, going through security, and getting on the plane. They know you are there...

Not only could they already know where you're leaving from, and going to, they could also tell what time you bought your ticket!! Oh man, they're tracking us already! (puts on tinfoil hat)

One word solution...

[alexandre]

microwave! :)

Bingo - and RFID is the wrong technology

[bobpence]

I pass hundreds of people in an airport who could have RFID readers and thus would have my data to copy and retransmit. Get that data from me and a few hundred other people and they will find someone they look enough like that they can make a very effective fake passport.

This data should not be transmitted contactless. Are you going to tell an immigration official, "Just scan the passport in my pocket"? No, you will still present the actual passport, so they can simple touch a smart card style chip on the passport to a reader and get the same information (more effectively than trying to pick out my info from that of dozens of others nearby).

Biometric info is not necessarily a bad thing, but RFID is not the right technology choice. Perhaps if I carry my passport in a tin foil bag...

Re:Bingo - and RFID is the wrong technology

[cavebear42]

3 things,
1. tin foil isnt the way to go but it is possible to use rf blocking materials to allow the rfid to only be readable when the passport is open assuming the cover of the passport was made out of them.
2. passive rfid would be the perscribed method as that it is much cheaper than active and it can only be read from about 4-6 inches in my own testing if the man is scouring your body with the little ray gun looking for your passport, you'd likly know.
3. my real problem is that rfid holds about the same ammount of info as a upc. the theory was to have a primary key to find a file in a db. we would could create a small circuit to broadcast large ammounts of data (like a picture) but then this isn't really rfid anymore, its just a radio brodcast.

Re:Not flaming, not trolling: simply another argum

[DougWebb]

More data = better predictions

That must be why people are so good at predicting the direction of the stock market; there is so much data around, and it's all 100% accurate, too. More data just tells you more about what happened yesterday. It does you no good in predicting what will happen tomorrow. Doug.

I have a better idea.

[mindaktiviti]

Why don't we enact foreign policies that don't piss off the rest of the world?

Or is this virtually impossible? Are there any good reasons for we the west is hated so much, that are absolutely necessary to our survival, and to others' survival? How differently could we do these things?

Re:I have a better idea.

[FusionDragon2099]

Yeah, but friendly foriegn policies aren't profitable.

Re:I have a better idea.

[Anonymous Coward]

It's not "the West". Most of the West gets on very well with most of the planet. It's the noisy ignorant kid on the block that's the problem.

Re:I have a better idea.

[Luscious868]

It's not "the West". Most of the West gets on very well with most of the planet. It's the noisy ignorant kid on the block that's the problem.

I'm sick and tired of people taking pot shots at Canda. Enough already!

Re:I have a better idea.

[lelio98]

I don't understand the argument that enacting security restrictions on visiting foreigners is a violation of their rights and will therefore upset them. Visiting foreigners have no rights in America, save for the ones that Americans wish them to have whilst they are visiting. If Americans decide that all visiting foreingers must go through a full body cavity search before entering the U.S., then they will have to submit to the search or be barred from entry.

I for one believe that we should utilize technology to it's fullest to secure our borders and points of entry. But infringing upon visiting foreigners privacy doesn't accomplish this.

What we truly need is full cooperation from allies and friendly nations. There is no reason we can't foster cooperation between law enforcement and intelligence agencies amongst our friends to help us keep out potential terrorists, or at least know where they are. This may be a bit of a pipe dream considering we can't really foster cooperation between our own law enforcement and intelligence agencies though!

What we should really be concerned about is whether or not the technology will really work. And, do they really mean to store biometric data on an RFID chip? I was under the impression that an RFID chip had a relatively small amount of memory (something like a 16,000 characters). Perhaps they mean a SIM card like in a cellphone or U.S. Military ID.

Re:I have a better idea.

[cfuse]

Why don't we enact foreign policies that don't piss off the rest of the world?

Or is this virtually impossible? Are there any good reasons for we the west is hated so much, that are absolutely necessary to our survival, and to others' survival? How differently could we do these things?

Well the RFID scanners are going to go nuts for you after that little outburst of common sense.

Unexamined assumtions AGAIN

[Catbeller]

"But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security"

WHY? What does a passport have to do with terrorist threats? Is everyone bloody unhinged?

An example of bad digital enhancement ...

[Master_Wu]

... was at my old company. They decided that people just weren't using secure enough passwords or changing them often enough. To fix the problem, they forced passwords to be x number of characters, with mixed capitalization, and at least one non-alpha character. Oh, and the passwords had to be changed every 90 days, and couldn't match the last four passwords. To make it even more confusing for the average joe, they decided to have the login password and email password be reset on different/staggered 90 day cycles, instead of the same time. On paper, it sounded like a good idea to lock things down, but in reality, everyone just started writing their passwords on post it notes on their monitor or at best, under the keyboard.

Besides, if the movies teach us anything, it's the experienced old cop who spots something out of place, while the young greenhorne smacks the battery casing of his incarcerator2000.

Why does it have to be RFID?

[SharpFang]

RFID is evil in this way that it can be read anytime by anyone without the person carrying it ever knowing. It's also very vulnerable to EMP, quite easy to damage, jam, fake...

Why not something that is just as simple but requires simplest of actions from the owner. iButton. Just touch the small metal can (immune to mostly all "environmental challenges") to a reader, and the contents are being read. Or a Java program (embedded in the chip non-virtual java machine,) is being executed. Or the data will be accessed only after answering to a proper cryptographich challenge Or, or... So if you want to pass through the customs, just touch the iButton with a jpeg of your face to the reader. If somebody wants to steal data from your iButton, they must mug you or trick you into placing your iButton against their reader (and providing proper passphrase which normally sits in governmental database)

Biometric pp introduced under duress

[Anonymous Coward]

Biometric passports are being introduced, in general, under pressure from the US. The US has suffered one major terrorist assault and is going through a knee-jerk over-reaction that not only pisses off its perceived enemies, but alienates its friends, too.

The US' border control system is geared up to stopping economic migrants, but is ineffective against those who have a clue and want to be there. Entry points are staffed by people who use their power because they have it, not because they're getting the job done with maximum efficiency and minimum inconvenience to all concerned. I've sat on an aircraft at LAX for 3 hours because Immmigration was too busy to accept us. When I got near the head of the queue 7 hours later, most booths were unstaffed and the guy checking me out ambled through his allotted task making sure he had plenty of time to sip at his coffee. On other occasions, I've been searched by people who clearly are neither trained properly nor, to be blunt, intelligent enough to be trainable.

No doubt a lot of the US majority hear grin to themselves thinking that's the way a great country can treat outsiders, but it's not. Security covers close observation, but includes good relations with friendly governments AND the citizens of those governments crossing the US border. All biometric passports means, is that the same idiots checking my baggage and passport on the last visit, will check my baggage and passport on the next visit.

Anyone wanting to enter the country illicitly will either do it by some other method over land borders, or with a fake biometric passport. You can't tell me these things don't already exist.

Oh, way to go on the new case locks that "only people with special keys" can open. What's the percentage of baggage handlers with criminal records at LAX?

Right now, the US treats its perceived enemies in contravention of international law, tries to ensure its own military are not subject to international law, and increasingly treats its friends as enemies. It's one way of doing business, but it's a fucking difficult corner to get out of.

A retinal scan is better

[Anonymous Coward]

It would be much better if retinal scans are the stored biometric. While still good for identity validation when both sides want it, it is hard to use a retinal scan for tracking a person without his/her knowledge.

IMHO it is the perfect privacy/security tradeoff. Now I wonder why governments prefer identity validators such as fingerprints instead...

Re:Parallels with digital vs. analog music copying

[jdunn14]

I'm afraid its more likely that the extremist Muslim friend who has gotten a job at whatever place issues these things and he will happily fulfill his 'duty' to Allah will actually be living paycheck to paycheck minimally educated worker who has gotten a job at whatever place issues these things and he will be more than happy to fulfill his 'duty' to the almighty dollar. You don't have to be some extremist to help the bad guys. Bribes are offered and taken everyday.

Critical thinking in the hizzle

[insulanus_hailstorm]

But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security

I am very disappointed that such uncritical thinking makes it through all of our BS filters daily. I know I go slack-jawed when I watch TV, too, but I try to slap myself really hard when it's all over.

There are many parts to physical security, and verifying that someone is who they say they are is only one part of it. Furthermore, one must make sure that the data cannot be copied, or used by another person. Lastly, you have to make sure that the datacon't easily be unlinked from what you are trying to authenticate (eg. Person's name and their face *shudder*)

Merely digitizing the data won't help one whit. Putting it onto a processor that can communicate without physical contact is even worse.

I am not going to comment on the privacy/liberty angle, because it is mostly orthogonal to the security question.

Why is Canada doing it? We have to.

[topham]

Canada is looking to do this because it is a requirement imposed on us by the United States.

Re:Why is Canada doing it? We have to.

[Anonymous Coward]

Same goes for the Netherlands. It will only be a requirement if you wish to travel to the U.S. Expect to see visitor numbers decline even more sharply than they have already.

digital ~= greater security

[tyler_larson]

There's no doubt that storing a duplicate of the printed information in a digital form (especially if cryptographically signed... which, sadly, it's not) would make passports many orders of magnitude more difficult to forge. That wouldn't help defend anyone against terrorists, of course, but it would help protect against fake IDs.

I admit that accessing the information using RFID is an unnecessary complication: It makes the chip easier to destroy at-a-distance and doesn't add much in the way of functionality.

Still, I'm not worried about the government using this technology to track my every move: I certainly don't carry my passport around with me wherever I go; many people don't even HAVE a passport. Hell of a tracking mechanism THAT would make.

two bricks shy of a load

[westlake]

...anyplace on the web, any photograph of the planes that hit WTC 1 and 2 where you can see passenger windows. I'd like to see it. All the pics and video clips I have seen show cargo planes.

...so you are content with this idiocy and haven't bothered to explain the "coincidental" disappearance of two fully fueled passenger jets, their passengers and crews?

What the hell are you talking about???

[xystren]

well, my U.S. passport has a line of characters on the bottom of the first page (y'know, the one with the picture of me on it). the characters include my name, birthdate, and passport number. everytime i've returned to the u.s. from travelling, my passport is opened to that page and run through a scanner slot. i assume they are reading these values (as far as i can tell, there is no magnetic strip on there). other countries usually just make me write down my name, address, birthdate, and passport number when i pass through customs. so, governments can already track me as i go about my personal business. as for matching the facial scan, good thing, it means that i won't have to worry about my passport being stolen and used.

Just a dumb question? Isn't that what the picture that you noted above is for?

And before you say that "well the picture can be changed"... If the bad-guys have the resources to do that, do you honestly think that a embeded chip is going to help? It's just like keeping your doors locked on your car. It will keep the honest people out, and the casual thief, but hell, with a rock, smash the window and I could make off with your Britney Spears cd collection.

I find your faith in the powers that be... disturbing.

---
sig line? We don't need no stinky sig lines

You can 'turn it off'

[Benm78]

Really, it would not be that hard to temporarely disable the RFID function. I can imagine how this RFID feature would be usefull when 'reading' the passport at, for example, an airport.

However, the RFID feature has no use when you just walk around with the passport in your wallet. In fact, this could be a privacy concern, since you could be 'tracked' without your consent. If you worry about this, loose the tinfoil hat and buy the tinfoil wallet.

Or you could carry your passport and other RFID-enabled documents and cards in a fancy metal case such as the ones used for cigarettes - unreadable as long as you do not open the case!

Re:You can 'turn it off'

[TheGavster]

This is actually a thought, if the cover of the passport were made of one of the many frequency-selective materials that have been developed. If you could only read the thing when its open, its a lot harder to sniff in a crowd.

On sale now!

[Anonymous Coward]

Tinfoil condoms :)

Can I pick all four?

[xystren]

Jessie Ventura said that "You can't legislate stupidity"

It's ashame, we are getting legislated by stupidity.

Re:Can I pick all four?

[t_allardyce]

Nah they're either stupid or they want to spy on everyone, now id really love to think that they wanted to spy on everyone because it would mean they wernt totally stupid, but, i think they are just stupid.

two bricks shy of a load/ you sure are

[Anonymous Coward]

People who would think nothing of killing thousands in the attack itself would again think nothing of killing the airline passengers someplace else and disposing of the bodies, probably through an industrial incinerator. They have large truck portable ones they use for cull animal disposable, like after hurricanes, etc. And as to "where" this might have happened, there are dozens of supposedly closed military bases scattered around that could accomodate large jets.

Anyway, show us a picture of one of the WTC "airliners" where it shows it's a passenger jet and not a cargo plane. And show us where the lawn on the pentagon got burnt up from burning fuel, and show us all the debris.

Oh yes, BTW, why did they destroy all the flight controller tapes of the events that day? And please explain how a prisitine passport of an alleged hijacker showed up a couple blocks away after the event, when everything else was destroyed. And how exactly where those aerial cellphones working at over 300 mph again? Oh yes, I forgot, government magic pixie dust.

Sorry, when you want to rag on a "conspiracy theory", pick the screwiest one, which is the "official" conspiracy theory. It's beyond laughable, it's into serious junk science range.

How does this increase security?

[DesertFalcon]

"But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security."

Maybe I'm being dense, but can someone tell me how (considering that the 9/11 terrorists boarded their planes with completely valid passports) having fancy-pants digital passports is going to increase security one tiny bit? This is saying nothing at all about the other problems with biometric "security" measures - the main one being that they're easy to fake.

It seems to me that people really like the idea of more gadgets being used to give an increased perception of security, when perceived security is probably the biggest threat to actual security that exists.

"What you want" is what the really want

[Chemisor]

> The three ways you can authenticate a person are:
> What they are, What they have, What they know

The trouble is that the government really wants to know "what you want", rather than any of those things. Using "what you are" to determine "what you want" works only by extrapolating from previous behaviour, and is necessarily restricted to past offenders. What we need is a passport that requires you to state your intentions every time you use it. It could go something like this:

"It looks like you are about to board a plane. Could you please reassure me that you do not wish to hijack it, blow it up, fly it into a government building, ignite your left shoe, have sex in the restroom, hassle the flight attendants, or behave in a threatening manner?"
"I am just going on a trip to Afganistan to meet some Mr.Laden or something. I don't know nothin' about all rest of that."
"Thank you for your cooperation."

Keep the dialog calm

[irritus]

- - I think we need to relax the tone when we talk about privacy issues like this. When we keep making references to 1984 and site personal opinions of the US President and foreign policy, we risk jading the uninformed. The same thing happenned with environmental issues. Throughout the 90's the news media bombarded us with a new environmental issue every year as if the world was going to end. The world didn't end. Now most people are apathetic problems that have only gotten worse. The only thing the average person does nowadays when the ozone layer gets more depleted is shopping for a higher SPF sunblock.

- - That being said, the issue is cut-and-dry. These passports won't stop terrorism. The only thing RFID passport will do is make it easier for people with good forgeries to get on planes. As people become more dependent on high technology, the number of people who can abuse the system becomes smaller but the level of abuse they can perform grows. This does not make anyone safer, it makes the elite criminals who can crack the system richer. You don't have to be an expert hacker to give someone a fake criminal record, you just have to have the money and resources to hire one.

- - You work in an airport. You're told the new security system is much better than the old one. It certainly seems more complicated to fake the system out. Therefore you are naturally less suspicious of anyone the machine approves. There only has to be one criminal out there who can make forgeries to fool your system. As soon as someone out there figures it out, this system is obsolete. Terrorists have money to burn, between selling opium and (the even more lucritive and addictive) crude oil.

- - Undetected forgeries are the first failure of all security; human beings are the second. Has everyone forgotten how it was the terrorists got into the cockpits of those planes? They took hostages, and the pilots broke procedure by opening the door. Since in politics you can't effectively shoot down an idea without suggesting an alternative, I have a solution that takes into account forging documents and faulty PeopleSoft.

Problems with the current solution:

• These new passports could be faked
• The 9/11 terrorists had valid passports
• The 9/11 terrorists were armed with weapons which (a college student demonstrated) can still be snuck onto planes
• Pilots could still fail to follow procedure (a hard thing for a human being to do when one knows one's choice will cause the immediate death of another).

Solution: Make stronger doors that can't open while the plane is in flight, and require all planes use them.

- - It's cheaper than adding all of this RFID crap, less offensive than racial profiling, and less intrusive than a body cavity search. Terrorists trying to force the door open would be stopped by Air Marshalls. When it comes down to it, stopping crimes before they happen is incredibly difficult, expensive, and ultimately impossible. Preventing crimes from completing successfully is far easier and less expensive.

couldnt say it better than this

[Anonymous Coward]

"But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security."

Benjamin Franklin once said
"Those who would give up Essential Liberty to purchase a little Temporary Safety, deserve neither Liberty nor Safety."

Well...

[Tuxedo Jack]

Just wrap your damn passport in aluminum foil already.

nice trick

[twitter]

Canada is looking to do this because it is a requirement imposed on us by the United States.

How much would you like to bet that US and UK lawmakers will later point to Canadian deployment as proof?

Don't worry, I won't blame Canada.

what threats?

[maxpublic]

But, with all of the terrorist threats lately

You mean the vague 'sky is falling!' warnings the government issues whenever it's numbers start to dip? Those threats?

The only way to end those threats is to shoot every politician in the country. That'll also end the threat to our privacy too.

Max

Just an update on Canada's position...

[Edward Scissorhands]

....The Canadian government had looked into this for Canadian passports but a decision was made recently not to change the passport.

OFF Switch

[Anonymous Coward]

Just make sure it has a damn OFF Switch.

Re:Not flaming, not trolling: simply another argum

[maxpublic]

Abnormalities which the government relies upon noticing, because tracking everyone 24/7 is impossible even for them.

Not only that, it's unconstitutional. But that hardly seems to be a concern for anyone these days.

Max

Wearning an invisible "bomb me" sign!

[a24061]

Isn't it great when governments make it easier for terrorists to target their own citizens?

If passports have RFIDs that can be read from more than a few cm away, terrorists will be able to build bombs triggered by the presence of citizens of specific countries. Politicians, thanks for looking after us!

What do you mean "just wait"? ; was "Just wait"

[FlutterVertigo(gmail]

Er, um....has everyone forgotten about Slashdot: July 14, 2004: Mexico's Attorney-General, now has a non-removable microchip in his arm, to track his movements and to give him access to a new crime database, according to Bloomberg. The article says that eventually around 160 Mexican officials will have a chip implanted. (Wired and CNN are both running the very similar Reuters report, too.) ??????

___________________
My TrunkMonkey can beat up your TrunkMonkey

Huh?

[ScrewMaster]

But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security.

Surely this is a troll. Surely.

The question is not whether this will increase security. It won't, of course, since America is a goldfish bowl with too many ways in and no way to control them all. Terrorists are perfectly willing to spend years and millions of dollars (pounds, rubles, whatever) planning each operation and they will find a way in. And I wouldn't be surprised to find this kind of embedded RFID system get hacked and be readily available on the underground market. At some point the things will need to be programmed, and if nothing else a supply of blank cards and a programmer will be obtained from whoever makes them. I mean, come on, black-market Social Security cards can be found and some of them are apparently indistinguishable from the real thing because they are the real thing. It's called an "inside job."

The real question is: from whom must we be secured? And why? I've yet to see any rational discourse on the subject from the OHS or any of the other government organs involved that really makes the case that these devices (or any other form of technologically advanced tracking of the citizenry) will help in the (ahem) "War on Terrorism." The net effect will be to inconvenience and incarcerate some number of ordinary citizens who haven't a terrorist bone in their bodies while the real nut jobs use their hacked RFID's to walk right through airport security.

England has spent an incredible amount of money in wiring their country with video cameras. The justification for this "investment" (and I use the term loosely) was to catch terrorists. Well, the camera network has certainly helped in apprehending purse snatchers and other petty thieves but things are still getting blown up over there, so one wonders just how effective it really is. Were heading down the same road, and when all is said and done ... will it catch enough terrorists to matter? Will it catch any? And will our society still be recognizably "free" at that point?

Re:Huh?

[raindrop#1]

Actually, the justification used for wiring England with video cameras was to combat crime and the fear of crime. Terrorism didn't really come into it.

Unfortunately, the cameras aren't all that effective at stopping crime. Apparently the criminals forget they are there and so go ahead and commit the crimes anyway. The footage is generally of a rather poor quality and so of limited use. And the cameras are placed rather high up (to avoid vandals) so only give views of the tops of people's heads.

That said, the cameras are very effective at combating fear of crime. Make of that what you will.

Also, for the record, we haven't had anything blown up here in England for quite a few years now.

Re:Huh?

[maximilln]

Unfortunately, the cameras aren't all that effective at stopping crime

But they do provide a good amount of profit to the vendors. This, of course, illustrates the point of the whole thing.

Re:Huh?

[cfuse]

The real question is: from whom must we be secured?

How 'bout our own governments for starters.

Re:Huh?

[ScrewMaster]

Yes, I know. The question was rhetorical.

It's not about the public

[BiggerIsBetter]

It's about compensating for inept security staff. The 9/11 guys *had* passports, but at least some of them should have been stopped for dodgy visas, IIRC. I'd say this is more a way of removing the human from the ID checking process - instead of having them notice details and remember warnings, they just have to scan the passport and the computer pops up a "Detain this man!" dialog. Which makes lots of sense in a snake-oil way, if you don't understand the technology behind it.

huh?

[darkpurpleblob]

or that governments could use the data to track their citizens as they go about their personal business

Huh? How would adding RFID tags to passports allow my government to track me any more than they do currently? I only have my passport with me when I travel internationally.

increases security?

[samantha]

Does anyone really believe that matching faces to passports will stop any but the already known/suspected terrorists from entering under a false passport? Does anyone believe that the determined minority of terrorists thus filtered cannot find those who can finagle such measures? Is security actually served by treating everyone as a possible terrorist? I thought we got over that stuff in the US during the McCarthy era. Apparently not.

Re:Not flaming, not trolling: simply another argum

[Anonymous Coward]

Not only that, it's unconstitutional. But that hardly seems to be a concern for anyone these days.

The constitution is just a document. It can be changed. Even if it isn't changed, it has no special magic powers. It merely specifies what those in power aren't supposed to do. If they ignore it, the constitution won't protect itself.

Microwave your ID card for a few secs

[Anonymous Coward]

A a citizen of a country with e-ID's, I'd prefer to stay anonymous when saying this:

Microwave your ID card for a few secs. Do it a few times. First thing that dies is the circuitry. Voila, your ID is analog again...

Sad thing is use of the electronic part is probably going to mandatory for social security and other things one has to deal with federal government with.

I don't want/need this.

As a belgian...

[HansF]

I'm not happy with this situation. Mind you , every belgian allready has a Sis-card. They say you need that card to get medicines, but with a bit extra paperwork you can get everything anyway.
I'll guess it'll be the same with this. The minute I recieve this card I'll put it in the microwave for a few seconds. I'll still have id, since it's printed on the card, but I won't be carrying that extra data with me.

Business idea

[jtgd]

This is going to happen, so let some entrepreneur start now. We need wallets, and passport sleeves, with a wire mesh woven in to make a "Faraday cage" to block RF from going in or out. This lets our RFID tags in our credit cards or whatever readable only when we want them to be.

RFID snort anyone?

[mesmartyoudumb]

Its the latest and greatest project on sourceforge!

The terrorists have won,they have succesfully defeated democracy and all it took was a few people and an airplane.

What crap.

[cfuse]

But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security.

How exactly?

Is it more secure? I think not ...

[Anonymous Coward]

I am from a country that has implemented to some degree what's proposed for RFID (a rather loose one though). What I have noticed is the following: going through custom is now a breeze. You walk through a private booth and you place your passport with embeded chip against a reader. This gets verified and you walk through. The problem with this is that nobody observes you anymore. You could be a chimp and still walk through with my passport. Just my 0.02 withe the embedded chip, going through custom has been changed to a

no RF in Belgiums new ID-cards

[vkt-tje]

The new Belgian ID cards (currently still in testing, nationwide distribution to begin once the village gevernments are convinced they won't have to pay for the extra cost ;-) ) will NOT contain an RFID chip, but a classic SIM-like chip with electrical surface contacts.

The Belgian government (at all levels) has proven its everlasting lack of gripping IT-technology over and over aigain: for example there still is no central repository for drivers licences (there are only 10^7 Belgians, not all drive...)
I therefore think Belgians have nothing to fear. For once security (of privacy in this case) through obscurity (by lack of knowledge by the gevernment) does work :-)

thanks, good link

[Anonymous Coward]

I've seen similar about the structural steel before, but that is a better link.

Those buildings had been packed with explosives before-hand and blown, that's the only rational conclusion. And WTC7, geez, that one in particular, you even have the owner quoted as saying they made a decision to "pull it".

Couple new videos out as well, "hiding in plane site" is one, and "painful deceptions". Both of them should be on P2P networks now, they are both authorised for legal sharing, along with alex jones "911 road to tyranny"

Here's a page on the magic cell phone calls

http://globalresearch.ca/articles/CHO408B.html

I tell you, this is some scary stuff, because they have suceeded in faking out so many people that we got fascist takeover domestically and massive never going to end foreign wars now. It's pretty sad even here on slashdot, almost three years later there's so many technologically oriented people who still buy the governments fairy tale, they bit, hook line and sinker, despite overwhelming evidence to the contrary. I guess it goes to prove if you tell the big lie loud enough and often enough most people will believe it.

It's even more sad when you realise the coup plotters will most likely strike again, this time perhaps with backpack nukes or biologicals or something. And now because of their actions we really do have a lot of islamic resentment. It existed before, but not in the quantity -or ferocity- that it does now.

Link to ICAO specification - get informed

[Anonymous Coward]

I can not reply to this subject in detail (due to various clauses in my contract), but I've seen a lot of uninformed reply's to this subject. For your information, most of the "e-passport" standards can be viewed by anyone from the following link:

http://www.icao.int/mrtd/download/technical.cfm

The last two links are the most important reads. As you can see there is a PKI infrastructure as well as anti-skimming measurements in place, though these are not compulsory.

As for RF - it would be easier to use than contact. Just think of the many forms of travel documents alone.

digital pasport stops terrorism?

[demon4]

ya wtf, terrorists can get legal passports. how does this help stop terrorist at all. this guy must be listening to too much cnn.