Passport Insecurity

by Baron Earl

2006-02-20 17:33:57

Deadly Things

With the growing identity theft problem in the United States, why is the government moving ahead with a technology that gives identity thieves another way to steal your personal data and allows terrorists to pick individual Americans out of crowds?

The Department of Homeland Security wants every American passport to include an RFID (Radio Frequency IDentification) tag identifying the person carrying the passport. The Dutch are introducing passports with the same technology, but when a Dutch television news program put the technology to the test they were able to intercept the passport data at a distance and crack the encryption scheme on a home PC in a few hours.

California driver's licenses have been magstrip-coded for years, and if Homeland Security's idea was to speed up U.S. Customs checkpoints a magstrip would have worked just fine, and it has the advantage of not being scannable from 30 feet away.

But wait! There's more! Although cracking the encryption could take an hour or two, you can get a unique RFID signature from a passport instantly. If you collect a database of signatures and crack them when you have time, you can later identify an individual passing by instantly with just the signature. Now when Americans travel abroad, technologically-inclined terrorists can scan a crowd and PICK OUT THE AMERICANS by scanning their passports remotely. Car bombs and improvised roadside mines could be modified to explode when a particular individual passes by. Why should a terrorist waste ammo blowing up a Halliburton rent-a-cop shuttling MREs around Baghdad when by simply checking the RFID signature they can target and take out high-ranking U.S. officials?

I still can't figure out what in hell the Department of Homeland Security is thinking. Using RFIDs for ID purposes is an insanely bad idea.

Check it out yourself

czech@pigdog.org