Slashdot Mirror
RFID Passports Raise Safety Concerns
CurtMonash writes "CNNMoney.com features a skeptical article about the US State Department's plans to soon issue RFID passports (currently being tested on State Department employees). One fear is that they can be hacked for information about you. And even if they can't, carrying around a little transmitter saying 'I'm an American! I'm an American!' isn't a fun and safe thing to do in all parts of the world." From the article: "Basically, you've given everybody a little radio-frequency doodad that silently declares 'Hey, I'm a foreigner,' says author and futurist Bruce Sterling, who lectures on the future of RFID technology. 'If nobody bothers to listen, great. If people figure out they can listen to passport IDs, there will be a lot of strange and inventive ways to exploit that for criminal purposes.'"
Yeah, that is important because I know when Americans visit say, China or India, they can blend right in with everyone else if they don't have that transmitter.
So if I wrap my RFID laden passport in tinfoil I am safe right? right?
I know that having your personal data stolen isn't any fun, it'll be worse if they put biometric data in there as well (I don't know what data the US passports currently have, in the UK we'll be having that put in soon). but for me a bigger concern is that they can be infected with a virus, which could quite easily be used to cause havok with the computers at airports and possibly bring the whole system down... the register reported on the proof of concept here: http://www.theregister.co.uk/2006/03/15/rfid_tags_ infected_by_virus/
*''I can't believe it's not a hyperlink.''
For my new lead lined briefcase. Who cares if it weighs 125 pounds.
"Would you, could you, with a goat?" Dr Seuss
How far are you broadcasting in the first place? If its like 10 feet who cares? Now in good practice, whenever I travel I leave my passport in the safe at the hotel. Not really a good idea to walk around with it ;)
http://religiousfreaks.com/Barring the bloody obvious target painted on you, they say in the article:
They'll have radio frequency identification (RFID) tags and are meant to cut down on human error of immigration officials, speed the processing of visitors and safeguard against counterfeit passports.
Human error will still occur in whichever system a human is involved in.
Couldn't they get all the same benefits with a simple barcode?
Does the RFID hold just your ID number for lookup on the database or is the RFID part now full identification?
I hope this doesn't go ahead (like the UK now isn't going ahead with its ID scheme) because whilst RFID might make tracking warehouse stock easy, its not great for humans.
Just because the technology exists doesn't mean we should use it for everything.
liqbase
Surely they cannot be unaware of how this could be exploited by those wishing to do harm to Americans, therefore I can only reach the conclusion that rfid passports are being pushed as a way for the government to ultimately track people in general. It would begin with being able to track foreigners and later as rfid makes its way into things like driver's licenses and auto plates, it could be used to track citizens. This is probably a goal of governments everywhere these days. First they'll tell you it's to stop terrorists, but with a flick of the switch, tracking citizens will be a breeze. I know the effective range is pretty short, but I can imagine that it would not be too hard for the government to build out an effective network, certainly in the most densely populated cities. It might even be able to piggy back on cell phone tower locations, so ordinary people wouldn't even know it was there. Ironically, true terrorists will be able to easily defeat this kind of tracking.
To the making of books there is no end, so let's get started
This gives me a great idea for a new business opportunity! Sell RFID tags to American tourists that broadcast to the world "I AM A CANADIAN".
Will you still be allowed to travel with just the written portion of the passport. Hell, just go around burning up other peoples passports and the riots will soon begin in the security line....
Why not just have the case lined with tin-foil or a thin metal sheet of some kind. Then when it is needed to be checked you have to open the case and/or take it out. These cases can be distributed with the Passports. In my experience with RFID wrapping it in tin-foil alone stops it from working (My work makes me use one to get into the office, yes I have tested this)
--Valthan
As I understand it, RFID cards don't do anything until they're exposed to an electromagnetic field, which gives them just enough juice to fire off a message, usually an identity code. Unless I've been completely misinformed, you'd have to generate quite the field to even have a chance of reading one of these things at a distance. I know that my RFID card doesn't work until it's within a coupla inches of the appropriate reader.
The whole "it's broadcasting all of your personal information!!!!" hype is a bunch of FUD. The only way it could really be a security risk is if the card itself was stolen, and then it's really no different than having your S.S. card or driver's license stolen.
"You will pay for your lack of vision..." - Emperor Palpatine to Ray Charles
With every technology advance in security, there will be those who break it. And then another technology advance comes, that will be broken. We've been playing this cat and mouse game for nearly 5000 years. Nothing is going change.
"I thought what I'd do was I'd pretend I was one of those deaf-mutes" ~ Laughing Man - GITS:SAC
US passports are good for 10 years from the date of issue. Get or renew yours now, before RFID becomes required.
Slashdot Burying Stories About Slashdot Media Owned
My guess is that some enterprising RFID Entrepeneur got into the Old Boys Network and landed some massive contract. Here in Missouri we have s imilar situation - Within just a few months of the state mandating increased ethanol in all gasoline, the governor's brother was found to have invested a substantial amount of money in ethanol (Matt Blunt is governor if your curious, see here for info on the ethanol scandal). Their orwellian response was simply to state that "there is no conflict of interest here."
It would be nice to know who got the contract, what city they live in and what relationships they have with government.
And even if they can't, carrying around a little transmitter saying 'I'm an American! I'm an American!' isn't a fun and safe thing to do in all parts of the world."
So, the issue, you consider is that the transmitter is giving away your nationality and NOT that it's a....I dunno. a BLOODY TRANSMITTER?( worst case scenaria, and I'm really going off the top of my head here, how about professional passport thieves:"Hey, there is a city building with 24 passports in there, let's see which suits are empty at the moment, and do some damage."(I'd think anybody smart enough to detect the signal would be smart enough to block it afterwards)). I'd be appalled if other countries follow suit, I fear that they will. Let's just hope that there is enough damage done the moment they try to use RFID's so the launch fails.
1. No sig. 2. ???? 3. Profit!!!
A bomb in a cafe that only goes off when there are over a certain number of americans in range. Or, if you can tell, when a certain number of american military are within range. Or a diplomat.
I just do not understand the insistance/fascination with RFID in this case. Think about the situation when these RFID's are supposed to be used. You are entering a country via immigration, and you hand your passport to the immigration agent. There is no need and no benefit to involving a radio. The agent could just as easily slip your passport into a reader which uses actual metal contacts as wave it over the RFID scanner. It would probably cost less, and would have none of the security concerns (valid or not) that the RFID chips have.
:-) Just walk up to the gate, wave your passport at it, and 'beep', you're back in the country.
I can only think of two possibilities. One is just good old fashioned corruption. It's no secret that the GOP has pretty much put a 'For Sale' sign out front of the Capital, so it may just be a way to send a bunch of money to a valuable 'doner'. Or they have some requirement which needs RFID, but is being kept secret.
I suppose they could almost completely automate letting US citizens back into the country. Will I be able to use my RFID passport to scan in to the country just like I do with my work badge to get into the machine room or co-lo? I can see benefits for having an express lane at immigration for citizens with RFID passports so we don't have to wait behind all the riff-raff
As I understand it, in order to read an RFID chip, you have to be close. We're talking a matter of inches. So, not only would the guy with the reader have to know exactly where your card is on your person, but he'd have to shove the reader practically right up against you. I think you'd probably notice if he started rubbing you with his suitcase.
I'm not saying it's impossible, but I'm not losing any sleep at night over my RFID card.
"You will pay for your lack of vision..." - Emperor Palpatine to Ray Charles
You have it right. I used to go to a school which used RFID keycards to open doors. In that particular case, it wasn't even a matter of inches - the card had to be within about two centimeters of the reader.
It would take a heck of a lot more juice than what those readers put out to make something that's actually useful for reading these passport chips remotely. Assuming the effective range on the readers I've used was exactly 2cm, the inverse square law tells us that doubling the power my chip out (and keepin the reader's receiver at the same power) would increase the range to 2.83cm, quadrupling it would get us to 4cm, octupling it would get us up to 5.66cm. . . and by the time you get to the point where a potential passport snooper isn't making himself *really* suspicious by running around an airport waving his briefcase next to everyone's baggage, you've got yourself quite an RFID reader. And then you throw on the shielding that's being put into these RFID passports and it's back to square one.
Not saying it's impossible to make a device that effectively identifies Americans by their passports, just saying that everyone should probably put their tinfoil hats on now because a device like that would probably give you one heck of a headache.
It's only passive until you bring it within range of a receiver.
That's secure in the same way as an object that's only invisible until you look at it, or a door that's only locked until you try the handle.
Passive RFID chips are likely harder to detect at range than active ones (for obvious reasons), but no-one's answered the question yet: Why do we need ranged querying at all?
Much, much safer would be a normal smart-card chip (like the one in your credit card) that requires physical contact to read anything. Frankly, once somone's got their hands on your passport it doesn't matter if it's a smart-card or normal paper one - they can easily find out things about you from it (or just nick it) at that point.
Allowing ranged querying seems to offer no really compelling benefits, and opens up a whole can of worms on issues like personal security, remotely tracking/identifying people without their knowledge, you name it.
Everything in moderation, including moderation itself
People fear what they don't understand.
The distance is more like 69 feet.
d =15719109
See http://yro.slashdot.org/comments.pl?sid=191202&ci
Valthan, you are a whiner. 1) That is a valid reference that people use to laugh about the way northerners speak. Its not even just Canadians though usually applied mostly to Canadians...almost EVERY northerner (specially north west) I have ever spoken to or hung out with has had the same accent. It was not started by southpark, it was started by northerners (including canadians) saying Aboot and Eh alot. In fact last time I had to deal with high level tech support it was a canadian guy...before the call was over I almost asked him to say "aboot" because he had said "eh" a dozen times already...but he said it without me asking and I about fell out of my chair (I hadn't slept in a few days fighting its problem so I was easily amused). Deal with it, many do say "aboot" and "eh" quite frequently. 2) You are right, with the exception of it makes Canada look like a terribly nice place to move to. So call it a real estate advertisement.
The only change I can believe in is what I find in my couch cushions.
It could be sold as part of the Canadian Disguise Kit, containing:
$50 in Canadian Tire Money
Milk in a bag
Those Groucho glasses with the fake nose and moustache on them (trust me on this)
Ticket stubs from a recent Gordon Lightfoot concert
and a mini Canadian phrase book
Where does the school board find them and why do they keep sending them to ME?
To have a right to do a thing is not at all the same as to be right in doing it
And from lots of experience, you have to be *right* on top of it for the reader to scan the tag. Usually they're either between the shoulders or by one of the hips. But if it's injected incorrectly or migrates, you literally have to rub the wand over the animal like you're combing it to find the damn thing. Take a beagle, for instance. If the chip is on its hip and you're scanning its ribs (all of 6" away), it won't pick it up.
So while we can argue the need of having RFID tags in passports in the first place, picking them up at a distance? Not going to happen without enough wattage to cook a chicken.
Chris Knight is my hero.
Another problem is people who generalize about individuals based on their nationality.
Knowing that someone is a United States' citizen should not be the basis for inferring that that individual supports the U.S. government's current administration or its policies, foreign or domestic.
Should I assume any Italian supports Berlusconi? That any German is a member of the CDU? That Tony Blair is every Brit's personal spokesmodel? That any Chinese is a fervent Communist?
I believe we all generalize and stereotype to help us maintain a tractably sized model of our environment. But to act on those stereotypes when interacting with individuals is unsophisticated and unfortunate.
Cheers,
Richard
Since RFID tags use the transmitting signal to send a reply, the strength and therefore distance that it will transmit or echo is dependant largely on the signal of the detector. Obviously the tags themselves can't rebroadcast an infinitely large signal, but the fact that you needed to get close to the doors at your school is a design feature of the doors and not a limitation of the technology. After all, they don't want doors unlocking just because someone is walking by...
http://www.schneier.com/blog/archives/2005/08/rfi
Never never never smoke crack before geometry class!
Everyone knows it's Alaska.
by the time you get to the point where a potential passport snooper isn't making himself *really* suspicious by running around an airport waving his briefcase next to everyone's baggage, you've got yourself quite an RFID reader.
8 .html
Of all the possible threat models, you've picked the least likely. If you are in an airport you can probably just look at the guy's luggage tags.
No, the threat is out in the real world where there is plenty of opportunity to disguise super-huge equipment. Like a doorway where the entire frame is a field generator and detector and the target is still only a few inches away, or the entire trunk of the car parked along the roadside, or along the sidewalk where the wall of that warehouse you are strolling by is just a thin piece of wood and on the other side is a some big-ass (and relatively cheap since there is no need to miniaturize) detection equipment.
Not saying it's impossible to make a device that effectively identifies Americans by their passports, just saying that everyone should probably put their tinfoil hats on now because a device like that would probably give you one heck of a headache.
Yeah, because humans have that 6th sense - the one that lets us detect EM waves. If you are lucky, maybe your watch will stop working, or your cell phone will drop a call and crash. Neither of which are particularly obvious clues to the layman that he's been whacked with a ton of EM.
BTW, here's a guy demonstrating a system to detect these RFIDs from at least 50 ft and who claims it goes a lot further. Note that whether or not he actually reads any of the data from the RFID is irrelevant, the fact that you've got one in the first place is plenty of information all on its own. http://blogs.pcworld.com/staffblog/archives/00079
When information is power, privacy is freedom.
You are basing your assumptions on the fact that there will be no advances in the technology involved with RFID readers. The fact that you had to be within a very short range for your school tag to be read doesn't mean that it will always be the case, or that your school didn't just go with cheap tech instead of a nicer reader. Further, the field to power the tag itself may be small, but what's the broadcast range of the tag? Could someone with a passive reader pick up the signal from your tag being read at a border? The research mentioned in the article seems to indicate this is possible.
Now, I must point out, that this article is based on old assumptions. As someone else pointed out, Bruce Schneier has been talking about these passports for some time, and has provided a number of suggestions to the government about how it can handle many of the issues he has raised. The current implementation calls for shielding in the covers of the passport that would render it unreadable when closed. If that works as advertised, then many of the issues that Bruce has with the passports are nullified.
IANAL... But I play one on
Ahhh... racist stereotypes. I suppose you think that all the Polish are stupid, that all the British have bad teeth, that all Irish are drunken potato eaters, that all Germans are Nazis, etc. The US has more than 220,000,000 people of a variety of races living it, and they all have their own statures and personalities which vary greatly.
As I stated in an earlier post, Austrailia, New Zealand and Singapore already have RFID passports. The information that can be obtained from the chip is encrypted, and will only be readable using the public-key which is encoded in a machine readable format inside the passport http://www.dfat.gov.au/dept/passports/. The plan in the U.S. is the to do the same thing, as well as putting a metal lining in the cover of the passport so that the RFID cannot be read when the passport is closed. See http://www.aimglobal.org/members/news/anmviewer.as p?a=394&print=no