Slashdot Mirror
American Passports to Have RFID Chips
pr1000 writes "Wired is reporting that the State Department is planned on adding RFID chips to new American passports, starting with diplomat's passports in January. Those worried about the privacy concerns of RFID should take notice, as this rollout could set a precedent."
Bruce Schneier has made some interesting observations on the RFID passport plans. Somehow, I do not see how this could possibly make us "safer".
And you thought it was just a Vitamin K shot.
This new step is another step towards control - remember, that is what this is all about. Bad guys get around the system - the 9/11 guys were all bona-fide visitors. Good guys, which is everyone else, gets tracked and watched.
I'm glad I'm outside the country 8+ months of the year.
What happens when these chips fail? Do you get locked up for tampering with a Federal document, or some crap like that?
Turn your bag into a faraday cage, keep your passport in your bag.
Let me get this straight. Assume I am a bad guy. If I want to find an American overseas - particularly in a country where carrying a passport is mandatory, how am I going to go about it?
To take it one step further, if I am wifi'd into a database somehow, I can even do a few smarts and identify a "better" target (wealthier, public figure etc).
I carry an Australian passport and it will not shock me when "the Clever Country" bends over and does what the Americans do - yet again!
Unfortunately RFID tags don't have much range. You'd have to be practically on top of your stuff to find it - that or have the whole town you're in set up to track RFID tags as they move through doorways etc. I think I'd rather lose my passport, cash and credit cards than have that, though.
Maybe... but it sounds to me that the thing is not going to be that difficult to hack.
:)
No encryption, only a digital signature...
He even admits it at the end of the article.
Now let's see what those tinfoil hats think about this. This could becoma a very interesting discussion
Anyway, once again I'm so glad I'm not American.
It's funny. Nudist colonies say they have nothing to hide, but now they'll be the only place *to* hide.
Wheel in the sky keeps on turnin'.
The difference is that with current passports, you have to show it, which has to be asked, and which you can refuse, so you have the ability to choose to accept the consequences of not showing your passport. With rfid tags it can be done without you even knowing it, and thus without you agreeing to.
When you show your passport at the airport or as means of identification at a bank, for instance, the same privacy issues arise, RFID or not.
Sure, RFID can be read from a distance, but many of us seem sooooo worried about RFID and yet happily keep carrying a mobile phone, willingly pay by card or withdraw money from an ATM, and get in view of security cameras. No tinfoil hat is going to protect against that.
If there are privacy issues, it is because someone decides to abuse the technology, RFID or not.
If you want privacy, pay cash only, stay home, don't use phones, and don't do anything that requires identifying yourself.
Visit http://ringbreak.dnd.utwente.nl/~mrjb/growingbettersoftware to download your free copy of the book
But you get to choose who to show your passport to. Anyone can read RFID information, as long as they can get reasonably close to you.
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
And those very same security "experts" obviously don't know that there are methods for secure encryption known throughout the world even now? You don't need to be an expert to know that!
And no, I can't see any other explanation. It cannot be the possibility of unallowed reading of the data: That's even easier if the data isn't encrypted at all. And it cannot be the possibility of making forged passports: Having data not encrypted makes this not any harder than having it encrypted with a known encryption.
Even in the worst case scenario, when the decryption key was made public by some other state, the situation couldn't get worse than without any encryption at all. Of course, the USA could just decide not to give the key (or any specification at all) to countries they don't trust. Those countries would then just have to do what they do now: Rely on the non-RFID portion of the passport (which is currently all that is in a passport).
So there is really no excuse to store unencrypted data on the RFID chip.
The Tao of math: The numbers you can count are not the real numbers.
When your clothes have RFID chips and your passport and driving license and you're in an environment where everything else has been chipped, are the scanners going to be able to pick up anything but noise?
As US passport authorities are indirectly forcing the rest of the world's governments to include biometrics in their passports (otherwise they will be denied the Visa Waiver Program).
Seems only fair that similar invasions of privacy should be imposed on Americans too. What's good for the goose...
I'll just microwave my passport like I do with my cash.
Grump
Is it true that more people vote for the winner of American Idol, than vote for the president? -Ali G.
From the article:
New U.S. passports will soon be read remotely at borders around the world, thanks to embedded chips that will broadcast on command an individual's name, address and digital photo to a computerized reader.
Any questions?
Government's idea of a balanced budget: take money from the right pocket to balance...oh who am I kidding?
So the US government is making it easier for people to target its own citizens. Nice.
RFID chips can be read from up to 50 feet away. Sure, most readers only work from a few inches, but there is off-the-shelf equipment available for a moderate number of dollars with a much, much greater range.
So, lets assume that the RFID chips in US Passports will be readable from "a long way away". Doesn't matter if it's 10 feet, 20 feet or 50 feet. Lets just say it's more than a few inches.
What does this mean? It means that a bomber with a moderate budget could build a detonator for an explosive device which goes off when it can detect the presence of an RFID chip.
It doesn't need to actually read the chip (lets assume the passport data is encrypted), it just needs to know it's there.
Furthermore, it could count the number of unique RFIDs which are currently in range, and only detonate the explosive when enough of them are seen at the same time.
It could be planted days, weeks or months in advance, and it'd sit there until its batteries ran down waiting for the right moment to go off.
The result is a bomb which only goes off when a sufficiently large density of American citizens is present.
- mark
-----
I tried an internal modem, but it hurt when I walked.
http://www.sciencedaily.com/print.php?url=/release s/2002/10/021015073446.htm
Gait Recognition Technology May Aid Homeland Defense
The characteristics of your walk may not be as distinctive as the swaggering of John Wayne or the sashay of Joan Collins, but your stride may still be unique enough to identify you at a distance -- alone or among a group of people.
Researchers at the Georgia Institute of Technology and elsewhere are developing technologies to recognize a person's walk, or gait. Results indicate these new identification methods hold promise as tools in the war on terrorism and in medical diagnosis.
Gait recognition technology is a biometric method - that is, a unique biological or behavioral identification characteristic, such as a fingerprint or a face. Though still in its infancy, the technology is growing in significance because of federal studies, such as the Georgia Tech projects, funded by the federal Defense Advanced Research Projects Agency (DARPA).
At Georgia Tech, one study is addressing issues of gait recognition by computer vision, and the other is exploring a novel approach -- gait recognition with a radar system similar to those used by police officers to catch speeders.
The ultimate goal is detect, classify and identify humans at distances up to 500 feet away under day or night, all-weather conditions. Such capabilities will enhance the protection of U.S. forces and facilities from terrorist attacks, according to DARPA officials.
"We need technology to find the bad guys at a distance around federal buildings," says Jon Geisheimer, a research engineer at the Georgia Tech Research Institute (GTRI). "That is the original application. And after Sept. 11, we began to see the usefulness of these technologies in airports."
Because gait recognition technology is so new, researchers are assessing the uniqueness of gait and methods by which it can be evaluated.
"We know that we can get some information on gait, but that it is much less diagnostic than faces," says Aaron Bobick, an associate professor of computing and co-director of the computer vision project at Georgia Tech. " Currently, we can't recognize one in 100,000 people. At the moment, gait recognition is not capable of that, but it's getting better so it can act as a filter."
In its early development, gait recognition technology likely will serve as a screening tool in conjunction with other biometric methods.
With two years of experiments and analysis almost complete, researchers on both Georgia Tech projects are hopeful for continued funding to conduct further studies. They must address numerous technical issues and it will be at least five years before the technologies are commercialized, researchers say.
In the project using radar for gait recognition, results from experiments, data analysis and algorithm design are promising, says Geisheimer, who works under the direction of GTRI principal research scientist Gene Greneker, and collaborates with GTRI research engineer Bill Marshall and Georgia State University Professor of Biomechanics Ben Johnson.
Gait recognition by radar focuses on the gait cycle formed by the movements of a person's various body parts move over time.
"The magic goal we're shooting for is accuracy in the high 90 percent range," Geisheimer says. "We're not there yet, but our initial results are encouraging and promising."
Researchers correctly identified 80 to 95 percent of individual subjects, with variances in that range among the three experiment days.
The next step is to build a more powerful radar system and test it in the lab and then the field. In experiments last year, subjects started walking 50 feet away from the radar and then walked within 15 feet of it. But researchers are now building a radar system that can detect people from 500 or more feet.
In the study of gait recognition by computer vision, researchers distinguish their approach from others with a techniqu
Does anyone else smell a business opportunity for Radio-shielded passport sleeves?
Nobody writes jokes in base 13. - DNA
This reminds me of a comment along similar lines.
When the U.S. mint added the shiny metallic strips to the bills, a friend of mine claimed quite seriously that it was so that it would be possible to "scan your butt" (or wherever you carry your wallet) to see if you were carrying loads of cash. My response at the time was sceptical, especially since the comment came from someone very non-tech, but wonder if it is even technically possible.
If the material is conductive, it should respond/reflect/absorb a specific frequency much like chaff does. Would it be possible to build a cash scanner? And if so ... "where can I get me one?" ;)
Beta is broken and the link to classic doesn't work. Stop wasting our time or there won't be anybody left here.
Hell, it's your country, your politics, your ideals, and your decision; I don't really care - it's mainly a curiosity for me that sociological values can change so rapidly.
I've just obtained a visa for the US, and had to give my fingerprints - I was curiously antagonistic towards this, and again it's nothing more than another incremental step. After thinking about it for a while I realised it's nothing to do with privacy, it's that I mentally associate being fingerprinted with being a criminal.
I felt I'd been judged and summarily convicted of something (what, I don't know, being an alien perhaps). As a reasonably law-abiding citizen (ok, I admit I sometimes exceed the speed limit on a motorway
Simon.
Physicists get Hadrons!
"Little does he know, but there is no 'I' in 'Idiot'!"
A very very scary thought occurred to me.
What if some terrorists connected such a transponder to an explosive device?
Imagine placing a bomb in some public place. A bomb that is totally harmless until a certain number of american passports are in close proximity and then BOOOM!
I hope someone in counter-terrorrism has thought of that and found a way to prevent it. If not they should do so ASAP.
1. RSA Blocker Tag
2. Tinfoil cover
3. Faraday cage purse.
There is no money in discovering RFID blocking devices. There is a possible market in creating a cheap RFID detector.
Revelation 13 (16-17)
And it causes all, both small and great, rich and poor, free and bond, to receive a mark on their right hand, or in their foreheads, even that not any might buy or sell except those having the mark, or the name of the beast, or the number of its name.
The bible always makes a good reading - not that I am a beliver, or so.
"I'm fed up with having to produce many bits of paper just to prove who I am"
They you should be opposing the 'identity' culture, not supporting it.
These chips will do nothing to make people safer (they'll be no harder to forge than current passports), but will certainly make some people less safe by broadcasting their information to anyone with an RFID reader.
Wrapping a tag in aluminum foil blocks the radio waves and prevents a tag from being identified. -
RFID Hack Could Allow Retail Fraud
Most of the concern seems to be around unauthorized person reading the RFID chip. According to this article blocking RFID chips is very easy to do if you have physical posession of the chip. Just wrap it in tinfoil. It would seem that someone would make a bag/box/pouch that would store your passport and protect it from being read w/o authorization. When you were in an area that required that you show your passport, the airport for example, you would just take the passport out of the bag. Sounds like a $19.95 solution to me.
I guess if you took your passport out at the hotel or some other place like that you could be "vulnerable". Maybe this solution from RSA woul help?
It does seem like the solution here is not to say "no RFIDs in the passports", but actually to ensure that there is a way to easily control when the tag is read. And there seem to be several solutions available.
Sorry for the "stupid" question in the subject line, but so far I (as an European citizen) was told that the USA is a democratic system. So I guess that the US citizens should be able to express their discomfort about RFID tagging in the upcoming elections. Just a thought of a naive European...
Of course, when asked by a policeman or customs official, IF there is cause to ask you. I have absolutely no right to ask you to show your id just to respond to this message for instance.
The day that you will be detained when you refuse to show your passport while buying a certain newspaper for instance will be a very grim day...
If you refuse to show it, you're detained. Then, they open up your wallet/purse and look. All you did was delay everyone somewhat and create trouble for yourself with no real difference between they're waving you over or pointing a device.
Oh really? If you refuse to show it at the hotel? In the cab? In a restaurant? At the movie theater? There is no technical reason anyone can't set up a reader anywhere they want to snoop.
When I travel, my passport never leaves me. It's such a comfort to know it will be singing out my name, age, photo and home address to anyone who's curious. I feel safer already.
Kill, Tux, kill!
Trolling using another account since 2005.
It is not easier to show, but it is a *lot* harder to hide. That's the point why everyone is making such a fuss around this issue, I think.
Today, you carry some form of ID, be it driver's license in the US, a national ID in Europe or whatever. You are most of the time obliged to show this piece of ID to law enforcement officers if they ask for.
Either the officer authenticates him/herself with his badge, a similar ID item or just the entire appearance along with police equipment and police car. So in 99% of all cases, I know when my ID is checked and by whom and I'm sure it was read by real officers on duty or someone is going to jail for posing as one.
With RFID, none of us can ever know if we were checked, let alone by whom. If that person was really authorized by law and duty to check us, we can only pray for. We want to hide our ID from anyone's eyes who has not identified himself as a lawful officer on duty. With RFID it is hardly possible.
If the regular police cannot or does not perform simple duties in plain sight, with proper uniform, without hiding the officers identity behind something, having the officers armed only with the law and a baton, our society as a whole is in trouble. Riot shields, handcuffs and a low power hand gun may be necessary at times, but cable ties, fully automatic rifles, masks are certainly unacceptable for me. Special units can have them, but regular policemen and -women should not. Hidden and unnoticed checks for unsuspecting passer-bys performed by guess-who are totally out of question.
Law enforcement should not use mobster tactics. Should not be armed like mobsters, should not act like them. This may give criminals and terrorists an advantage, but it is the only way to make sure we can distinguish between officers and mobsters. If we allow the police to act like the mob, guess how long it takes for these two to merge...
You can build an RFID tag that will DOS the system, but you first need to know how RFID works.
The RFID tag is simply a sequence of bits. You can ask about portions of its tag -- "do you start with sequence X". There is no way to communicate with only one tag; if you send a request, all tags in range hear it and send an affirmative signal if they do start with that sequence (and nothing otherwise).
When a reader needs to scan many RFID tags at once, it sends a signal saying 'Whose next bit is a 1?' and 'Whose next bit is a 0?' and counts the chirps for each response. When it gets zero chirps, it knows to stop (there are no tags with that ID). If it gets only one chirp, it has found a unique tag and records it. Otherwise, it recurs down both trees.
If you build a device that always says 'yes' to both questions, the reader will have to recur down both trees 'forever' or give up until you leave range.
This seems to have the desired effect of preventing RFID scans without your knowledge, and it would certainly be handy to be able to turn it off at will.
LincolnQ
We want to hide our ID from anyone's eyes who has not identified himself as a lawful officer on duty. With RFID it is hardly possible.
Well said.
I don't have much of a problem showing an ID to someone that asks for it, and I know why and what they are looking for and who they are. But being surveilled to the point that they have a complete ID on me with no physical intervention is a little scary.
Its not too tough to track someone today after the fact with such things as CC receipts, easypass things, witnesses, phone records, etc. But these things take a warrant, again after the fact. Being criminally investigated in realtime, err, no thank you.
How does this work? If you treat someone like a child, they will act like a child. If you treat someone like a criminal, they will be a good upstanding citizen? I don't think so.
If the feds want to update the passports with electronic technology, use barcodes or something. Actually, the more I think about it, it might be much more stealth to have a reveresed engineered passport RFID tag to say whatever you want. I don't see how this would be illegal because its not fraud or falsifying a document because if anyone asks for the passport, give it to them, but drive by scanning, I'm Homer Simpson and my ssn is 078-05-1120. Thanks for asking.
The 'terrorists' upon whose actions all of this insane police state nonsense is based were funded and manipulated by both the U.S. and Israel specifically because the psychopaths in power want to stay in power so that they can have all the money, power, sex and cocaine. Having to work for a living, or serve in the military, is scary for them, and so they choose instead to trick all the trusting citizens into believing in 'terrorists'.
Anybody who looks at the details clearly will see the manipulation.
Remember the 'terrorist' passport they, 'found' on top of the smoking remains of the WTC?
That is just one of a hundred loose threads, and if it doesn't get your brain ticking, then you are either sleeping or dead, and you richly deserve the hell you are seeing rise around you.
"Oooh. But Conspiracies don't exist! It's impossible for a large number of people to keep a secret!"
Yeah? What the heck does that prove? NEWSFLASH: Conspirators do not NEED to keep secrets when the populace has been brainwashed into constantly looking the other way whenever a piece of evidence pops up.
People would rather fight and yell and argue in favor of the psychopathic manipulator rather than deal with the truly awful possibility that they are being raped. This, in fact, is exactly the reason psychopaths are so dangerous. Normal people are hardwired into certain behavioral traits which make them excellent marks for this sort of manipulation.
Any 'terrorist' who uses RFID passports to blow up Americans will be doing so with the consent of the military industrial complex, and your spreading of fear is making those jerks giddy with the joy of a mind-job successfully executed.
I have to live in this world, too, and imbeciles like you are contributing to the misery smart people also have to deal with. Arrogant? Gee, sorry. I'll just quietly go off to a barbed wire camp so you don't have to feel like an idiot.
-FL
It seems to me that it will eventually make it easier to forge Passports.
People are lazy and cheap.
The government doesn't want to have to pay a bunch of agents to look at passports and agents don't want to have to look at passports all day long. I predict that with RFID chips embedded in passports, there will just be devices that you wave your passport near and they will check to see its validity. There will be a security guard nearby to jump on anyone that fails the scan, but nobody will be actually looking at the passports.
Along come Mr. Forger. He no longer needs to concentrate on making special paper, holigrams, and the like: all he needs to do is make it look decent and put a good RFID chip inside.
The only problem: where to get some valid RFID numbers. That's easy! Just hang out at the airport for a few hours with an RFID scanning device, brushing against people and scanning their passports. Then take home the numbers and create some RFID tags with them.
This wouldn't work as well if a picture popped up on a security guard's screen so that they can verify the holder of the passport looked like what they had on file, but...people are lazy.