Privacy vs. Security: Biometric E-Passports

ftblguy writes "Countries such as the UK, Belgium, Netherlands, Canada, US, Australia, and New Zealand are currently looking into adding RFID chips to citizens' passports. The chips would contain data such as a digital image of the person's face. A real-time facial scan of the carrier of the passport would then be matched to the data encoded in the chip. But privacy advocates such as CASPIAN are concerned that this data could get into the hands of the wrong people or that governments could use the data to track their citizens as they go about their personal business. But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security."

Comments

Just wait

[sugapablo]

Soon they'll want to implant RFID tags (or something similar) in your left molar. Everyone will be able to be traced from a simpe computer terminal. Great for parents who's kids are kidnapped, or hikers lost in the mountains, bad for everyone else.

Re:Just wait

[denthijs]

And all in good spirit of a non existant terror threat.
America hasn't put itself on a threatlevel lower then orange and probably never will.
A quote from 1984 might be the best justification for this;

The war isn't meant to be won, the war is meant to be continuous

I only hope the US-citizens will see this for what it is and not re-elect another 4 years of warmongering.

Re:Just wait

[danormsby]

But why do this with RFID as a unique tag? Surely our faces or speech or irises are unique enough. Hold a database of those rather than implant another unique key?

Re:Just wait

[Everleet]

I only hope the US-citizens will see this for what it is and not re-elect another 4 years of warmongering.

If we had a choice, we probably wouldn't. Unfortunately that issue, along with every other issue the government faces, has already been decided by the Party. The public has the oh-so-heavy choice of which face reads their speeches for the next few years.

quickly, think of a reason,

[way2trivial]

and order a 'sample quantity' know..

they'll be needed in the years to come...

paranoia

[Anonymous Coward]

A real-time facial scan of the carrier of the passport would then be matched to the data encoded in the chip. But privacy advocates such as CASPIAN are concerned that this data could get into the hands of the wrong people or that governments could use the data to track their citizens as they go about their personal business.

well, my U.S. passport has a line of characters on the bottom of the first page (y'know, the one with the picture of me on it). the characters include my name, birthdate, and passport number. everytime i've returned to the u.s. from travelling, my passport is opened to that page and run through a scanner slot. i assume they are reading these values (as far as i can tell, there is no magnetic strip on there). other countries usually just make me write down my name, address, birthdate, and passport number when i pass through customs. so, governments can already track me as i go about my personal business. as for matching the facial scan, good thing, it means that i won't have to worry about my passport being stolen and used.

Re:paranoia

[Rakshasa Taisab]

But what they cannot do is scan your passport while you are protesting against $EVIL_POWER.

Although if you have a cellphone...

Kidding, right?

[CleverMonkey]

Whenever I hear "with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security," I cringe. The idea that something which sounds like increased security will actually amount to increased security without any real analysis is an all too common reaction these days.

Think about the TSA (Thousands Standing Around|Take Scissors Away) - does taking knitting needles make anyone safer? The biggest change in airline safety because of 9/11 was 9/11. Before folks figured that they could just quietly land in Cuba and live on peanuts for a few days before they would be brought home. All that has changed, but it didn't require billions of dollars, air marshals, or any of the other visible crap the government did to create the illusion of security.

While biometric passports might make identification more certain, you need to fully look at who/where/how passports are used, and see if these measures will actually be useful in the real world. Urg.

Re:The price you pay...

[tpgp]

...if you don't want terrorists to drive airplanes into large buildings

You are a retard.

The 11/9/2001 terrorists had valid passports. This system would have done nothing to prevent that attack.

"with all of the terrorist threats lately"

[AC-x]

How the hell will this protect us from terrorism? I'm sick and tired of our governments trying to implement 1984 under our noses in the name of security.

For example, I'm sure no-one would notice if a farmer bought a load of fertilizer and diesel fuel, and no one would notice if he drove a van into the centre of some large city, but that's all he'd need to do to blow up a lot of people.

The only way we can truly protect ourselves is to quite literally monitor everyone's actions 24-7, but if that were the case I'd rather live in North Korea.

Re:"with all of the terrorist threats lately"

[mindstrm]

Huh?

A typical farmer would by TONS more than McVeigh used in Oklohoma. That's the point.

Building a bomb, especially if size isn't too much of a consideration, is EASY. There are many, many ways to do it.

Further, it doesn't take a large bomb to make terrorism work.. someone tossing sticks of dynamite (easily available all over the world) into nightclubs would get people worked up just about as well. The whole point of terrorism is that it's cheap... a single event and a few deaths is so spectacular that everyone forgets to put it in scale. More people died in car accidents in the US last year than did on Sept. 11th, but the US isn't throwing billions into auto safety or cars that self-drive. More people died from smoking-related disease, but you don't see the government outlawing tobacco.

Re:The price you pay...

[rokzy]

exactly, how about making the authorities show they are capable of understanding and using regular passports before they make things 10 times more complicated with RFID ones.

False dilemma

[Kris_J]

Prove first that these new technologies will in fact increase security and then I'll argue the privacy case.

I disagree

[savagedome]

But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security

First of all, and as 300 other comments would be pointing out by now, all those bastards on 9/11 planes had valid passports too. Whether passport is valid or not doesn't prove nothing.

Plus, IMHO, its harder to forge a non-digital passport. Thats a real skill. You can't walk into Radioshack, buy $70 worth of equipment, come back home and start playing with the RFIDs on the passport if its digital and all.

If its a non-digital passport, sure as hell if you indeed plan on forging/tampering it, you will have to find someone highly skilled that can accomplish that. And, if its a bad forgery job, its very easy for a human being to spot that.

My 0.02

make sure EVERYONE can read the chips

[Anonymous Coward]

Not just Government officials. My security is NOT increased by a powerful elite having information about me while I don't have information about them. Surveillance technology is probably unavoidable. But if implemented in the "Free World" (or the West), it should be Public Access, so that any citizen can keep tabs on anyone. Recognise that that most schemes that the government proposes do NOT follow this principle, as they are really seeking additional power over the populace, not seeking to help security.

Preserve the balance of power: require all surveillance systems to be public-access.

It's too late now

[WildBeast]

Privacy is on it's way out.

You can't *increase* security

[DrSkwid]

Only reduce insecurity

"with or witout"

[Anonymous Coward]

"But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security."

You mean, without terrorist threats it wouldn't be an increase in security?

In additon, what exactly makes you think that this will "increase security"? Has security been defined? Can we measure it? Before and after introducing these passports?

Cheers!

Re:This may decrease security...

[Overzeetop]

Actually, it makes things less secure, because the training courses will emphasize that these "unbreakable" cards will give nearly perfect results. A good forgery will be even less likely to be questioned.

Most of the cr@p instituted falls under the "keeping honest people honest" area of security.

Why is this either/or ?

[imsmith]

Is it necessarily a foregone conclusion that privacy and security are in opposition to one another? I'll grant that privacy and sloppy security are opposed, but why have sloppy security at all?

It seems to me that we (anyone who is the subject of either privacy or security) should be expecting BOTH, not accepting the proposition that the privacy-security issue (or the liberty-security issue) is a zero-sum equation.

Yes, in the U.S. the current politics seem to indicate that 'They' don't care, but what I'm really saying is, even if the government doesn't care, shouldn't the governed?

At the risk of sounding like a zealot, semantics matter and when we speak of privacy and liberty being 'traded' for security, we are tacitly conceding that we can do without either if we are scared enough. I personally want more liberty and privacy when I'm scared, not less.

Just a thought to the writers of headlines and story titles.

Re:Why is this either/or ?

[tom's a-cold]

Is it necessarily a foregone conclusion that privacy and security are in opposition to one another? I'll grant that privacy and sloppy security are opposed, but why have sloppy security at all?

It is indeed a false dichotomy. The things that are really opposed are phony security and justice. Here's why: all these security schemes can be thought of as statistical testing protocols (systems that yield 1=Al Qaeda, 0=John Q Public). To make matters worse, the ones proposed by the Bush junta are incompetently designed. They have the properties of bad statistical tests: poor sensitivity and a high false-positive rate. The high false positive rate means that very large numbers of innocent people will be falsely accused. Since this government is opposed on principle to due process, a large proportion of these people will as a consequence be falsely charged, imprisoned, or subjected to other forms of harassment with no recourse. And all this for a system that yields little or no additional security.

The real security is in having a political system that we all have a stake in, and that we're all willing to defend. Since the present system is (at best) only interested in our well-being in the same way that ranchers are interested in the well-being of their livestock, the only "security" solutions we've seen have been imposed from the top down. That makes it look like a lot like the Iraq war: a highly committed faction wants it in order to serve their own agenda, so it is then proposed as a "solution" to any number of problems that, logically, have nothing to do with it. Eventually, to be seen to be "doing something," the idiots in Congress allow it to be implemented, and catastrophe follows.

If they can't measure you, they can't manage you. With the most likely outcome of closer management being more comprehensive exploitation, the best strategy is to strongly resist any attempts to further track or monitor us.

Even if (despite all evidence) the Bush regime has no nefarious plans, putting such a system in place creates an opportunity for future abuse. Experience of politics in the US shows that the main deterrent to such abuse is lack of opportunity, not moral inhibitions or the successful application of the supposed checks and balances of a rotten system.

Re:Why not ...

[Overzeetop]

Because we're not scared enough...yet. As things ratchet up in the loss of freedoms, we will feel "safer." Each "event" will scare us to agreeing to the next level.

For small losses of freedom, a simple raising of the terror alert level to red (or violet, or puce, or whatever the top is) will suffice. But to start chipping people, it'll probably require another attack (and that attack will come). It may also take the form of "convienience" - if you get chipped, you can walk right onto the plane. Then it will be come an "inconvienience" - if you're one fo the few not chipped its, "please step aside for a body cavity search."

The oceans fill up one raindrop at a time.

What "terrorist" threats?

[Anonymous Coward]

You mean the ones based upon ancient and/or falsified information, much of it obtained under TORTURE by the U.S. Military?

The "war on terrr" has only three purposes:

1. To make key members of the US govt. richer
2. To control citizens every move
3. To realise biblical prophecy by igniting a "clash of civilisations" between east and west, ultimately resulting in the Zionists dream of "greater israel", leading the way for armageddon. The palestinians and a billion and a half arabs are standing in the way of this.

That last bit might sound a bit far-fetched, but ask any fundamentalist christian zionist - for example one of the ones that have successflly brought about a coup in the U.S government.

Now - you're not going to like any of these reasons - which is just why the govt want your biometric information on a national database so dissenters may be traced whereever they are.

In order to do this, they have to scare you witless. This is what the endless "war on terror" is here for. The "terrorists" don't wear robes or turbans. They wear stars and stripes tie pins and appear on FOX news.

Re:What "terrorist" threats?

[maximilln]

Falsified? Like explosives found on a rail line in France? Like a train station in Spain being blown up?

Spare us the drama. In the order of world events these happen on a yearly basis. We're not doing any better, nor any worse, for having spent $80 billion to launch a war against this sort of thing. The only thing that $80 billion has done was increase the debt to the Federal Reserve, ensuring that we taxpayers are eternally screwed, and lined the pockets of those who are closest to the federal trough.

Like capturing a Filipino national, and threatening to behead him if their government does not accede to their demands?

Again, spare us the drama. The US declared war. It's war! Must we whine about how the enemy isn't being very polite in a war? Do they expect the enemy combatants to surrender immediately? If the US didn't want to see this sort of thing happen they shouldn't have started a war.

Like explosives found in London?

Oh the horror.

Like two bars in Bali being blown up?

There was a bar blown up in New Jersey too. Turns out that was just some fancy pyrotechnics. The point is that this sort of thing happens with a rather predictable yearly occurence.

The sun rises every day. It's not a sign.
The leaves fall off the trees every year. It's not a sign.
People die, some less happily than others. It's not a sign.

The war on terror is a money-moving front. Nothing more, nothing less. There has been no significant increase or decrease in the regularity with which world travesties occur because of it. We won't talk about the sudden increase in the severity of US initiated world travesties. Even assume that bin Laden was the perpetrator. What's the score? Bin Laden has 2 buildings and 2500 lives. The US has leveled two entire nations and cost {classified} number of lives. I think they report the number as less than a dozen if you want to believe it.

Politicians are unlike any job in the nation: they never have to set goals. All they do is allocate your money to someone else. There is no accountability, at all, anywhere.

"Sure to increase security"

[Gothmolly]

Yeah, right... so any Russian hacker or spotty-faced teenager can crank out fake passports in his garage. How long before the government's über-ROT26 encoding scheme is cracked? Once more, we'll end up with rules that penalize the law-abiding, while providing no protection against the criminal. Normal people will have to go through the annoyance WHEN, not if, the RFID tag in their passport fails, or is misread, and they are taken for Osama bin Laden, or Teddy Kennedy.
Or wait, was this -1, Sarcastic?

Re:"Sure to increase security"

[t_allardyce]

I think it will provide a good income to pick-pockets, gangs will get together with rfid scanners walking around airports reading peoples cards and selling the data for a big proffit. They wont even need to touch you! and think of all the places they could get you - stick a reader under a chair in a cafe or waiting area and just reap in all the data you get, taxi-drivers in dodgy places want to earn some extra? let the local mob fit your car out with readers in the seats. RFID readers will be hacked and will be availiable to the public or atleast criminals and whats more they will be getting allot smaller and cheaper. People are already corrupt and even if you can guarentee customs/police/id-makers are straight in your own country you cant guarentee it in other countries using barcode encryption might work for a while but what happens when a real reader is comprimised?

Moderate Article?

[Potor]

But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security

Surely, this is a non-analytic proposition. And as such, an argument must be made. It is not evident that security will be increased. What is evident, however, as many people have pointed out, is that the volume of data-bases containing personal data will be increased. Nothing more.

I have two questions for the submitter

[Tim C]

1) How is this sure to increase security? Known terrorists are hardly the problem now; implementing this won't help against the known ones, and the unknown ones, well, they're unknown...

2) What do you mean, "lately"? Some of us have been living with the possibility of a terrorist attack all our lives.

Bingo - and RFID is the wrong technology

[bobpence]

I pass hundreds of people in an airport who could have RFID readers and thus would have my data to copy and retransmit. Get that data from me and a few hundred other people and they will find someone they look enough like that they can make a very effective fake passport.

This data should not be transmitted contactless. Are you going to tell an immigration official, "Just scan the passport in my pocket"? No, you will still present the actual passport, so they can simple touch a smart card style chip on the passport to a reader and get the same information (more effectively than trying to pick out my info from that of dozens of others nearby).

Biometric info is not necessarily a bad thing, but RFID is not the right technology choice. Perhaps if I carry my passport in a tin foil bag...

I have a better idea.

[mindaktiviti]

Why don't we enact foreign policies that don't piss off the rest of the world?

Or is this virtually impossible? Are there any good reasons for we the west is hated so much, that are absolutely necessary to our survival, and to others' survival? How differently could we do these things?

Re:Not effective

[RayBender]

Actually i find the concept to authenticate against what you are very insecure.

That's one problem. Another is that you can never change that authentication token, the way you can change passwords or keys. Imagine a scenario where you work at the airport and the Evil Terrorists (tm) manage to get a copy of your fingerprint (can be done with latex gel and an eraser) or retinal scan and can use it to access something important. The only secure response is to deny access to anyone with a fingerprint that looks like yours, forever. So either you never work again, or you get to have a special password system just for you (and all the other ID-theft victims). But of course, at that point primary security rests with the password system; which you miight as well just use in the first place.

Biometric security systems strike me as being very similar in spirit to the various copy-protection schemes out there that the RIAA loves; they sound intimidating and high-tech, but are really poorly thought-out and only good to keep out amateurs, while serving to make all our lives more difficult. I wonder if our security guys really do think that al-Qaida really is a bunch of amateurs? Are they?

As for biometric passports - why in Ashcrofts name would you keep the biometric information on the passport as opposed to in a central database? If your ATM card didn't rely on a central server the banks would have been cleaned out long ago. I have no doubt that professional forgers, being the third oldest profession (bureaucrat being the second, and we all know what the first is), could sooner or later figure out how to encode the biometric information. In other words, the passport has to be considered insecure and information on it shouldn't be trusted.

Now, if you don't keep the fingerprint scan on the passport, why make a big fuss about "biometric" passports? Deliberate misinformation? Or is it a two-step scheme where the retinal scan is too big to transmit, so a copy is stored on the passport and e.g. a hash on the central server to verify the integrity of the passport?

Of course, you can still hump it across the Rio Grande, biometric passport or no biometric passport. So now we have to start checking people inside the country as well as at the border. Sooner or later this road leads only one place: frequent random searches of all citizens and demands for "Your paperz, bitte" anywhere, anytime.

Unexamined assumtions AGAIN

[Catbeller]

"But, with all of the terrorist threats lately, bringing passport documents into the digital world is sure to increase security"

WHY? What does a passport have to do with terrorist threats? Is everyone bloody unhinged?

You can 'turn it off'

[Benm78]

Really, it would not be that hard to temporarely disable the RFID function. I can imagine how this RFID feature would be usefull when 'reading' the passport at, for example, an airport.

However, the RFID feature has no use when you just walk around with the passport in your wallet. In fact, this could be a privacy concern, since you could be 'tracked' without your consent. If you worry about this, loose the tinfoil hat and buy the tinfoil wallet.

Or you could carry your passport and other RFID-enabled documents and cards in a fancy metal case such as the ones used for cigarettes - unreadable as long as you do not open the case!

OFF Switch

[Anonymous Coward]

Just make sure it has a damn OFF Switch.

Wearning an invisible "bomb me" sign!

[a24061]

Isn't it great when governments make it easier for terrorists to target their own citizens?

If passports have RFIDs that can be read from more than a few cm away, terrorists will be able to build bombs triggered by the presence of citizens of specific countries. Politicians, thanks for looking after us!