© 1994 - 2007
Against the Grain

Site Design, Hosting and Logo
by DNA Web Media

Biometric passports have made it out of the discussion and testing phase. The State Department's Office of Passport Policy, Planning, and Advisory Services recently announced that it is ready to begin issuing biometric passports.

These passports, which feature an RFID chip, will bring about speedier and more secure entry into and exit from the United States, the government says. However, critics say the technology behind the passports is flawed and puts your personal privacy at stake.

The New National ID

According to the State Department's proposed implementation rule, the agency plans to issue the first passport carrying an RFID chip by mid-2005.

That chip includes all the personal data found on the information page of today's passports. It also contains a biometric component--a digital facial image.

Within a year, all passports issued in the U.S. will feature this technology.

The new passports will comply with requirements set forth by the International Civil Aviation Organization. In 2003 that group adopted a global plan for the implementation of machine-readable passports containing biometric information for its 188 member countries, the United States included.

Your New Passport

The RFID chip will contain a chip identification number (printed on the chip when it is manufactured) and a digital signature (a series of numbers assigned to the chip when the passport is issued). The two numbers will be stored in a central government database along with the personal information contained on the information page.

Once the chip is printed, the information stored on it cannot be altered. Because of this, the Department of State has decided to eliminate today's passport amendments: Going forward, if your information changes, you'll need a new passport.

Normally you have to pay a fee to receive a new passport, but under the new system you'll have one year from when your information changes to apply for a new passport free of charge. That's key, as the price of passports will go up to cover the cost of the new technology. Congress has authorized a $12 surcharge to all new passports, which brings the cost of new 10-year passports from $85 to $97.

Protecting Your Information

The State Department says that information contained in the passport chip will not be encrypted because it's no different from that viewable on the information page. Plus, it says, encrypted data takes longer to read and requires more complicated technology, which makes it difficult to coordinate with other nations.

One of the primary concerns with using RFID chips in the new passports is that the chips can be read from a distance. That means that, potentially, someone with the proper equipment could access the data on your passport if they are physically close enough.

How close is in question. Some privacy experts allege that the RFID chips can be read from as far away as 30 to 65 feet, while government officials say it can be read only in close proximity. The State Department will require all chip readers to be electronically shielded so that electronic signals sending and receiving information will not be transmitted beyond the reader. Additionally, each passport will contain an anti-skimming feature designed to prevent identity thieves from activating and reading the chip from a distance, they say.

The State Department may be trying to protect your privacy, but public interest groups like the Electronic Privacy Information Center say the technology itself is a poor choice.

"Anybody with a little bit of money can read the passports at a distance without getting your consent," says EPIC Technology Fellow R.P. Ruiz. "As a citizen, I would have serious doubts about carrying a U.S. passport. I would feel my government is placing me at unnecessary undue risk."

Ruiz says RFID technology is a scary choice when it comes to electronic identification. "What does being readable from a distance have to do with authenticating a person's identity?" he says. "Why the heck is this not a contact card?"

More Secure?

A contact card, which would be readable by placing a passport or card through a slot (like a credit card), Ruiz says, would significantly reduce the risk of identity theft. RFID "is great technology for tracking cattle; it's absolutely horrible technology for tracking people.

"People who want to read it will [and will do so] at a very safe distance," he says. He also says this type of technology makes it easy to "surreptitiously track anyone's comings and goings. It makes it very easy to target people in public places."

Another area of concern for Ruiz: State Department rules state that if your new passport's electronic chip is damaged or stops working you don't have to replace it. The agency reasons that since that same information resides on the data page of the passport, there's no need to replace a damaged chip.

Ruiz finds that policy puzzling. "If that component is broken," he says, "it's no more secure than what we have now."

If you're concerned about the security of the upcoming passports, Ruiz offers this advice: "Get your paper copy right now before they go electronic."

Passports are valid for a long time, he notes. "You can have five to ten years for [the State Department] to see the error of their way and do it right later," he says.

Mar 21 ET Technology - PC World
Erin Biba, Medill News Service