I'm no fan of RFID technology in general, but I'm really steamed about the new series of U.S. passports issued beginning mid-year, which will contain them. So are a lot of other people - and not necessarily hard-core privacy-rights types. These chips contain a storehouse of sensitive private information about the passport's owner, and the information can be 'read' by electronic scanner devices from as far away as three feet even while the passport is safely tucked away in a purse, wallet, or coat pocket. Having this personal information vulnerable to silent "surfing" carries some profound risks.

Identity thieves, kidnappers, and terrorists could not only identify American citizens in public spaces, but obtain their name, home address, biometric information, personal identifier numbers, and so forth in a fraction of a second. Combine this identity data with any other information available on U.S. citizens - health records, corporate marketing information or financial records - and the malfeasance that could occur is mindboggling.

The frightening part is that the passport never even need leave your possession for this theft to happen. You'd never know if the stranger that walked past you at the hotel desk stole more than just a furtive glance.

A few of these identity-"surfing" tragedies - especially international ones - may need to occur before our government decides to revisit, recall or replace these passports. Unfortunately, no one seems to be able to provide a valid, non-civil-liberty-infringing reason (besides the volume of data that can be stored in the chips) why RFID technology is better than, say, magnetic strips or laser-scannable barcoding. Whether in the U.S. or abroad, American citizens will be at a marked disadvantage and increased personal safety risk any time their passport leaves home.

I've been searching to see if there are any easy ways to prevent unauthorized "surfing" of RFID chips (besides extracting the chip carefully with a razorblade, or popping the whole passport in the microwave - EMP pulse, anyone?), and apparently ordinary aluminum foil wrapped around the chip disrupts the scan signal to a certain extent. As a commenter on this thread notes, "Thanks - now those tinfoil hats have a use."

From Daily Kos: While traveling it is smart to keep your passport on you at all times, but with today's world-wide political climate, it is a very dangerous time to have a big red flag labeling you as an American anywhere you go.

Thugs could just scan a walk-way for Americans and use their detector to decide whom to mug, rape, kidnap, or murder. Once they have you, they will know exactly where your passports (and any valuables kept with it) are hidden. If your car or hotel gets broken into, thieves could find your passport right away without any trouble by simply running a scan. This would be much easier than even using a metal detector as the signal would be giving out the passports exact location.

I've had my things broken into while visiting many countries (France, Tunisia, Turkey, Israel -- and in the USA), passports are very popular among thieves as is the money they are often kept with.

Additionally, the information on these tags could easily be read by anyone with a scanner, without having to even come in contact with the actual passport to let you know your privacy was compromised. This opens a whole new world of security issues depending on how much information the government chooses to store on these chips.

Officials are saying that the information on these tags would be protected through encryption, but I don't think that's good enough. I would bet hard cash that once the passports start rolling out, it will be just a few weeks (if not days) before some tech students somewhere crack the code. Just look at how long it took for DVD encryption to get hacked!

Officials are also saying that the passport's "jacket" would include an aluminum-foil type material to block out the signals from your RFID tag so it couldn't be read unless the passport was open. While aluminum foil does a good job blocking RFID signals, this just isn't good enough. I don't know the specifics for what the government has in mind, but I don't imagine it being full proof especially once criminals are actively trying to find ways around it. And a passport has to be opened when used as ID (at a hotel, bar, or whatever), and can easily open a crack (or more) while in your pocket or backpack.

Caveat: from what I understand, the passport chips are "passive" - that is, they contain no internal power supply that powers a signal, but if a scanner sends a radio signal the chip responds with a packet of information generated by the chip, powered by electrical current induced in the chip's antenna coil by the scanning signal. Not that this makes these passports any safer, of course. The government now says it will equip the chips with an encryption algorithm, requiring a "key" generated by reading a barcode inside the passport itself before the RFID chip data can be accessed. Ahem...new challenge for hackers/crackers, anyone?

More: WIRED News April 26, 2005 - Feds Rethinking the RFID Passport
EFF (Electronic Frontier Foundation) Deep Links on RFID Passports
Engadget: U.S. Changes Mind About RFID Passports...Sort Of.
AIM Global Network: RFID-Tagged Passport - Deterrent or Threat
Tech News World

---