Tuesday, 29 March 2005
Deadlines loom for RFID tracking chips in USA passports
There's still time for USA citizens to get a new passport without an embedded RFID remote tracking chip -- but if you want one, you should apply at once. The Department of State is moving as fast as it can (slowed down only by technical difficulties -- RFID chips are proving more difficult to manufacture, more fragile, and less reliable than their boosters have claimed) toward the rollout of the new "electronic passports". And there's still no plan to encrypt any of the information on the RFID chip. Each chip will be digitally "signed" by the State Department, but that's for authentication, not as a control on access to the data.
Anyone who gets close enough to your passport with an RFID reader will be able (without your knowing the chip has been read) to determine your nationality, name, gender, date of birth, place of birth, passport number, etc. as well as receive a digital copy of your passport photo, for the convenience of identity thieves in forging a duplicate passport (with a clone of the RFID chip, including the digital signature) or other identity documents in your name and with your image, but perhaps with a signature in their handwriting (the signature, which might be slightly harder to forge, won't be digitized or digitally signed) for the use of criminals, terrorists, or anyone else who resembles your appearance.
RFID chips in passports would also be available for use by merchants, marketing companies, and commercial data aggregators who could use them (secretly and remotely) at entrances and exits to commercial establishments, checkin and checkout counters, cash registers, etc.) as unique personal identifiers to compile logs of consumers' (travellers') movements, purchases, and other behavior. Since international travellers almost always have to carry their passports, embedding RFID chips in passports would effectively remove any possibility to opt-out of such tracking (especially in jurisdictions, such as the USA, where such data collection, usage, and "sharing" is unregulated), much less to require consent or "opt-in".
The USA State Department is currently accepting public comments through Monday, 4 April 2005, on new proposed regulations related to passports with RFID chips, which they are referring to as "electronic passports".
These are not the regulations to establish the inclusion of RFID chips in passports. That requires no change in regulations, and has already been decided. But the new regulations are critical to enforcing the requirement that holders of passports issued with RFID chips allow themselves to be tracked. The crucial element of the new regulations is a new clause which would allow the State Department to invalidate any passport issued with an RFID chip if the chip was no longer functioning for any reason. The point of this rule is to prevent citizens from defeating the tracking function of the RFID chip embedded in their passport. Use of any "technical fix" to prevent reading of the passport would, under these proposed regulations, invalidate the passport (in the same way that physical mule or alteration of the photo or any other essential element of the passport currently invalidates it).
A new Web site, RFIDkills.com , offers more information about the proposed regulations, including links to denunciation so of them by the Association of Corporate Travel Executives and the Business Travel Coalition .
Anyone can submit comments on the proposed regulations. Comments must be received by 5 p.m. Washington, DC, time on Monday, 4 April 2005. You can either send your comments by e-mail to PassportRules@state.gov or use the form on the RFIDkills.com Web site . (All submitted comments will become part of the public record, but you don't have to give any further information than your e-mail address and perhaps a name.)
[Addendum, 20 August 2005: The format doesn't make them easy to navigate or browse, but the State Department has posted more than 2000 of the comments they received on their Web site. I didn't read them all, but all those of the comments I sampled were opposed to the RFID passport proposal.]Link | Posted by Edward on Tuesday, 29 March 2005, 12:39 (12:39 PM)