Slashdot Mirror
RFID Drivers' Licenses Debated
meganthom writes "How would you feel about having an RFID chip in your driver's license? Virginia is considering just such a measure, largely because several of the 9/11 hijackers were licensed there. Civil rights advocates are obviously unhappy with this turn of events, and it seems the ACLU has already taken the case. Proponents claim it would help law enforcement determine that you are who you claim to be and would make forgeries less common. The Federal government is also considering uniform 'smart card' standards."
How soon until you can buy a pocket ID sniffer/cloner? Or the plans become available on the latest 'warez' site? Great. Just by walking down the street 20 people can steal my identity...
A pickpocket's dream come true! You can steal from a passerby without laying a hand on them.
I doubt an RFID in a drivers licence is any kind of deterrent when you're prepared to hijack a plane and kill yourself and everyone else in it by crashing it into a building.
FUD time...
Proponents claim it would help law enforcement determine that you are who you claim to be and would make forgeries less common.
Yeah? It would make it easier for me to know who you are too. One enterprising geek on the subway could snag everyone's identities. You thought cell phone cloning was a problem? Hoo buddy.
Joe Geek might not be able to forge an ID, but he doesn't have to in order to snag someone's identity.
Might want to tin-foil coat that wallet...
I'm ok if the cops fisically get my card and read it, but not Ok if they can do that remotely
But that's just me
Virginia government officials need to keep reading this until they get it:
THE 9/11 HIJACKERS HAD VALID DRIVERS LICENSES.
THE 9/11 HIJACKERS HAD VALID DRIVERS LICENSES.
THE 9/11 HIJACKERS HAD VALID DRIVERS LICENSES.
THE 9/11 HIJACKERS HAD VALID DRIVERS LICENSES.
Stop using the hijackings to justify your pet police state!
I probably wouldn't mind either if there was a such thing as a completely secure system. What if the technology is compromised? If you trust the RFID system and remove all other safeguards (as in your login example) your entire system is compromised if someone can duplicate your identity. You can't just change your password to recover. This is the same problem with biometrics -- someone figures out how to break it and you're screwed -- can you change your DNA/fingerprints/retina?
fair enough, you wouldn't mind.
but I'm not getting Viriginia's apparent reasoning for introducing the RFIDs - "Virginia is considering just such a measure, largely because several of the 9/11 hijackers were licensed there". How would have RFID helped? It's a non sequitur.
As I understand it, the issue wasn't that identification failed at the airport. So how would RFID have helped?
-- james
More direct attacks on privacy and tracking all Americans, in the name of 9/11, with something that would have had absolutely no effect on preventing the 9/11 attack at all.
Perhaps a better idea would be to not give terrorists drivers licenses at all, or maybe not to give illegal alliens drivers licenses at all. Instead many states (including mine) have gone out of their way to make it easy for known illegal alliens to obtain drivers licenses! But somehow at the same time this is being used to justify making people cary one more thing that will make it extremely easy to track them.
Kind of makes you think that all those crackpots who question how and why World Trade Center Building 7 collapsed when it wasn't even hit by planes, the only skyscraper to ever collapse from such a fire before or since, might be on to something.
I'm an American. I love this country and the freedoms that we used to have.
How, EXACTLY, would the 9-11 attackers been stopped if they had been issued RFID drivers licenses? There is no sane connection. I can't think of any easier examples to prove that government and businesses are taking advantage of the 9-11 fear to lock us down. PATRIOT acts, car transponders, GPSed cell phones, RFID armbands, implants, RFIDed ID cards, biometrics... NONE OF THESE THINGS would have stopped those men from crashing those planes into the towers. But that attack is used to justify every possible wet dream of a police state.
Now, onto Project TinFoilHat. If issued such a card, I will build a Faraday cage into a belt pouch, and there their assine tracking device can sit until a POLICEMAN asks to see it. I know damned well they can build RFID detectors that can work at great distances; I will not cooperate and being tracked on a giant Ms. Pac Man screen by whomever can afford the equipment.
As for those of you who don't care about this, you are good Germans. What else can I say.
As it stands, I can walk into my local supermarket, purchase any number of items(using cash), and walk out. No one ever need know who I am. RFID Identity scanning would allow any number of people to know not only WHO I am, but WHERE I've been. That is the significant risk in allowing technology like this in place without proper security measures, both for the government, and for my personal protection. Iron out the security, make me feel safe, and I'll think about sticking an RFID tag in my wallet.
BUT, the licenses that the hijackers had were LEGAL licenses (i.e. they went through the process of getting a license and were granted one). The problem isn't the fact that the license itself is not secure, but the PROCESS which grants the license is NOT SECURE. FIX THE PROBLEM NOT A SYMPTOM.
That is just my 2 cents.
We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
You carry your licence so that people know who you are, and this would just provide a better way to verify that information.
I carry my drivers license so I can drive. I have no interest in other people knowing "who I am".
Give me Classic Slashdot or give me death!
US Federal officials announced today that, since some of the 911 hijackers were found to have used Route I-95 during their preparations for their terrorist attack, this highway would be permanently closed from 11am Tuesday to prevent its use in future atrocities.
Similarly, Oldsmobile saloons would also become proscribed items on the same date. Current owners of Oldsmobiles have until 15 October to hand them in to a Federal car pound.
You know almost all of the 9/11 terrorist had valid state issued ID? Why would adding a RFID tag help stop terrorists? The can still go up and apply for a valid id just like everyone else.
I wonder if the inclusion of a driver's photograph on a license generated this much "panic". Was the very idea of putting a person's picture, address and data of birth on the same state-issue card interpreted as a trampling of civil liberties? Using a smart card as a driver's license and including things like driving, citizenship or criminal record on the card would make sense for law enforcement, provided some effort was made to hinder access. Getting this information for anybody is a trivial matter in the US. If every attempt to ensure some level of security is met with gnashing of teeth by the ACLU/EFF/et al these organizations are going to be completely ignored by policy makers (more than they already are)
I carry my drivers license so I can drive. I have no interest in other people knowing "who I am"
You can drive without carrying a license. The only reason to carry one is in case you need prove who you are.
Please... this is absurd.
What exactly do you do when you are:
- Applying for a job?
- Applying for a loan or bank account?
- Writing a check or using a credit card?
- Getting into a bar or purchasing alcohol or gambling or any other activity with an age requirement?
Driver's licenses are the only uniform photo ID issued in the US. To imply they are only for the purpose of driving implies you are either under 18 and unable to take advantage of most other uses for ID, or you are sitting at home much too often.
Ironically, the word ironically is often used incorrectly.
what makes you think that the people passing this law won't also make it illegal to purposely block or interfere with the signal?
It seems to me that the proper course of action would be to prevent this from becoming law in the first place.
I carry my drivers license so I can drive. I have no interest in other people knowing "who I am".
Unless you get carded in a bar.
Or a store employee insists on verifying your identity while using your credit cards.
Or you want to apply for a passport and need two forms of identification.
Or you're filling out your employment forms and need two of the following: passport, driver's license, birth certificate.
I'm sure you could think of a few others.
The problem with this and all other National ID card ideas that have been proposed is that they are inherently secure, because they result in people treating a single piece of information as both public information and as a secret. As an example, concider your Social Security Number. This number is used for two purposes
1) It is a unique identifier that the government (and others) use to differentiate you from others.
2) It used as a means of authenticating that you are who you say you are.
This creates a problem, because in order for the SSN to be usefull as an identifier it will be handled out in view of the public, but in order for it to be used as a means of authentication it must be kept secret - which it is not! It frightens me how many entities act as though anyone who can rattle off my SSN, must be me.
What you are doing is exactly the same. My drivers license number is not private information, and using it as a password is highly insecure!
I would really like to see a standardized authentication system worked out that used a public key / private key / password system, on a smart card. Technically it could work the same as PGP signatures. The public key is is associated with a unique ID, and available on public servers. The encrypted private key exists only on a smart card and cannot be read off the card, and therefore all computation must be done on the card.
The entity wishing to recieve authentication (say safeway) would read my unique ID off the card and send it to the authenticator (say VISA) who would send back a challenge. I would then enter a password (likely pin number) into the local machine. Then the challenge and password would be fed into the card which would use then use the password to decrypt the private key and then sign the challenge with it, and feed out the response. Then safeway would send the responce to VISA who would check it with the public key and securely return their decision.
If computers came with a slot for the card, standard, it would provide for an easy-to-use secure method of authentication for anything that needs it. I could have a card the proves that I am Citizen #123-45-6789 and another that proves I am allowed use VISA card 1234-5678-9012-3456, and other that proves that I am gate_keeper2345@example.com. And having a standard secure method of authentication, could even increase privacy because then entities could choose to athenticate you on criteria other than knowing who you are so they can sue you if things go wrong.
We do not have to carry our papers.
Yet.
"The natural progress of things is for liberty to yield and government to gain ground." - Thomas Jefferson
If you don't want to fly, drive, hop on a boat or a train, cash any checks or purchase alcohol maybe you can get by without an ID. Sadly, it is effectively a requirement to be a member of society/life, liberty, pursuit of happiness etc. and therefore the argument you make that arbitrary restrictions or conditions imposed on license holders is kosher entirely because said holders are free to take them or leave them is, prima facia, stupid.
I thought RFID would only transmit some unique identifier. In other words, the identity information is not stored in the RFID chip, but in a database in a server somewhere; the RFID only supplies the index key to the (presumably) correct record in the server.
So, I don't see why RFID suddenly makes stealing people's identities so much easier as half the posts on here are claiming. You'd still have to hack into the db to know what the details of that person are if you randomly stole the code from the RFID chip.
--RJ
After reading through other responses, the use of RFID appears to cut both ways. (Much like our personal use of firearms, it's all in the application.)
On the good side, reliable RFID could speed your way through computer-mediated transactions, particularly in authenticating access to facilities or systems, paying bills, driving through toll booths (EZpass comes to mind) and similar transactions.)
On the bad side, if someone steals your token (either physically or through cloning), they can do all these things, too. Also, instant ID could be used to exclude you from events if the gatekeepers have access to the database.)
"I'm sorry sir, but you can't come inside. Our system shows that you attended a Kerry rally this morning, so I'm afraid the Secret Service now considers you a threat to President Bush('s re-election)."
As with any good security schema, you need more than one element to make it secure. RFID in your driver's license is only a physical token; you need either a password/PIN or some biometric (or both) to provide additional authentication..)
What will be crucial is what information the RFID system stores and transmits and under what circumstances. For commercial transactions, maybe the RFID DL will just contain your name and a link to a database with the rest of the info needed to complete the transaction. If you've buying something at Radio Shack, they should only get verification of who you are, not your phone number or address (though they will most assuredly lobby for access to that info). If you're applying for a mortgage, the bank would probably be authorized access to more detailed information..)
And you should have the absolute right to both control how much autonomic access anyone has to your Privacy Act protected data and to turn off the RFID function whenever you want..)
However, as with any form of ID, people don't have to transact business with you if you won't provide the authentication they want. Life is full of distasteful little trade-offs.
TLR
A man no more knows his destiny than a tea leaf knows the history of the East India Company
You carry your licence so that people know who you are, and this would just provide a better way to verify that information.
How is it any better than the magnetic strip on the license? Because its high tech?
IMO its a lot like the story last week about the tokens to be used to verify the "kid" online is really a kid. All it does is wrap the high tech mantle around security which makes people think its safer, when really its not.
So how does using an RFID tag make it any more secure? IMO it would be less secure because it would be much easier to spoof an RFID than a magnetic stripe.
I'm genuinely curious, what is it you're afraid of? Life is sometimes hard and good people sometimes die. Is it worth living in a police state to somehow keep that one set of crazed morons from blowing something up? Honestly, is it worth it?
How about this: Let's stop pissing people off so that they don't feel like it's worthwhile to blow our stuff up. Then, let's stop blowing up their stuff so that they won't have any reason to retaliate.
There, we're right back where we should have been pre-9/11. Stop being frightened by the boogey-man-terrorist. Oh, he's out there alright, and he's real, but I'm much more worried about the crazies here in our own country, with valid IDs, that think they need to kill their girlfriends when they break up with them, or hold babies out of car windows while driving, or go on a sniper rampage in Washington DC.
You can get struck by lightning, or a car can come careening out of control and smush you into the sidewalk in a New York Minute. Drunk drivers are way more dangerous than any terrorist to you. Police-state Gestapo tacticts are way more dangerous to you than any terrorist.
I've had my "fair" share of profiling. This brings it to a whole new level.
If used correctly, (I know, HUGE if) this could actually be an argument FOR the situation you describe. Most "minority profiling" isn't entirely based on racism, an entire profile. In the situation you describe, wouldn't it be nice to have your chip tell the officer you are a good, law abiding citizen BEFORE he gets up to your window? I understand it's not fair to have to be flagged as "one of the good ones", but it still works in your favor to be treated that way. If you happen to be driving on I-95 North in a Cadillac with tinted windows and New York tags in North Carolina as a pair of african american males between the ages of 18 to 25, it's not entirely unreasonable for you to be more likely to get pulled over for speeding. It would be good if the cop knows you have no criminal record BEFORE getting to the car and assuming you are a carrying drugs.
Just a little Devil's advocate from my home in Utopia, where everyone plays nicely and doesn't abuse overreaching powers.
Never confuse volume with power.
"Virginia is considering just such a measure, largely because several of the 9/11 hijackers were licensed there."
because wouldn't everyone agree that it would have been just so much better if the 9/11 hijackers had Virginia drivers licenses with RFID chips embedded in them when they flew into the WTC. Sigh. Putting RFID chips in drivers licenses doesn't make it any harder for someone (terrorist or not) to get a drivers license. It wouild make just about as much sense to say "Virginia is considering just such a measure because tasty smoked ham is made in Virginia. There's no correlation between the two, but every effect must have a cause, so we'll use ham." I'm thinking that the "logic" here is that if they know someone is a terrorist, they can use RFID chip scanners to find them more easily. But if you know someone's a terrorist, then maybe you should arrest them when they come to pick up their driver's license in the first place, or when they get their airline ticket, or when they get pulled over by a cop for speeding, or at any other time when they actually present their driver's license and/or name. This is a solution to a problem we'd love to have. If someone could solve the problem of figuring out who's a terrorist, and the only obstacle was in finding them, then maybe this would be usefull. As it is, this is a solution to a problem that doesn't exist.
Pound! Bang! Bin! Bash! is this a shell script or a Batman comic?
I would not mind if they used some kind of credit-card magnetic strip system which had your Liscense # and birthdate on it (so both police, and stores that 'card' people could swipe--but the latter only for the birthdate info, not to track purchases)
but No, I don't want the guy in the car next to me to figure out who I am, or the guy I'm standing in line next to at some store to gather my RFID info...
Also a Virginian. Not by birth, just for work. Although not a Gore supporter. Just anti-bush (not the female kind). I have considered moving to another country because things are getting out of hand. The problem is I LOVE this country. I keep hoping US citizens get their heads out of their asses and stop destroying this once great country. I still have HOPE.
Personally, I do not give permissions for anybody to monitor my behavoir in this fashion, be them the government, or the private companies who will find this a convenient way of monitoring purchasing habits. If in your ideal world, everyone is conveniently trackable by law, that's fine, but I'll be fighting it every step of the way. If you feel it's your right to force this on me, then I'll see you at my mountain stronghold in a couple years.
"'Yrch!' said Legolas, falling into his own tongue."
But once again, if it is only useful in very close proximity (inches), what advantage would it have over a magstrip or barcode, both of which are much cheaper to implement, and both of which are in place already?
You see the threat as being blown out of proportion, I am asking some very simple, logical questions, the only answers to which that I can find are very disturbing. I.e.:
1) There are already cheap, effective, short range solutions in place to make casual counterfeiting of identity cards more difficult. It seems illogical to push a more expensive, and no more secure method unless it provides some advantage the other methods do not.
2) RFID tags that are only readable at very short range are certainly possible. Although I would tend to submit that range has far more to do with the scanning gear than with the RFID tag. The most commonly used, and therefor the least expensive, can easily be scanned by parallel columns set across doorways, a la almost every store you go into these days. The government requirement may refer to an advanced tag that can only be measured at short range (See point #1), however I find it much more likely that that they would be planning to use common, commodity tags which can be easily read from a distance of 2-3 feet, if not further.
"Unheard of means only it's undreamed of yet,
Impossible means not yet done." ~~ Julia Ecklar