EmailEmail
PrintPrint
Puts & Calls: What's the frequency, feds?
Critic sees all sorts of problems with new passports with high-tech radio frequency tags
Sunday, April 24, 2005

Imagine that you, an international traveler, discovered that you were carrying a device with you that were a sort of James Bond tracking bug.

From a distance of tens of feet to tens of yards, it would reflect a radar-like ping that announced its presence to those with computer and radio equipment. Up close, it would send more detailed information, including your legal name, nationality, a photo of you and other confidential information.

The danger of such a bug is obvious.

Con artists and thieves would know valuable private information and be able to target you in a crowd. Pickpockets would know which pocket to pick. Terrorists would know which cafe to bomb.

When you discovered this device on your person, would you discard it? Would you call the authorities to report it?

Sadly, this may be a reality and none of these options will be open to us.

That is because this device is a passport and it was planted on you by the Department of State in the name of security. These new passports will contain new security-related information about you and a Radio-Frequency Identity tag that allows them to be read from a distance.

Some security experts are concerned about the information that new passports will contain. I am less concerned about the actual information in the new passports than I am with how that information is made available, especially because there are alternatives that are not only safe, but also cheaper and more reliable than RFID tags: two-dimensional bar codes.

RFID tags are useful devices that are becoming part of the retail supply system to identify and track goods from suppliers through warehouses to consumers. They have value because they allow large amounts of product to be quickly and accurately moved to those who need them.

It is these efficiencies that have seduced the State Department to consider their use in passports. RFID can permit them to make border crossing speedy, letting travelers be scanned as they walk through customs as a pallet is shunted through conveyor belts.

Unfortunately, what is an appropriate use of technology for bottles of shampoo is not an appropriate thing for citizens.

While warehouses need to have ever-increasing efficiencies, the reason to have a border is not efficiency. I have no love for standing at immigration control, but I accept that there is a reason for that second word, control.

The Customs official should look me in the eye, ask me a question or three, and use the power of human judgment to assess the threat I do or do not possess before letting me in. That person also will look me up in a database, but when I'm being personally assessed, it is a perfect time to let an optical scanner look at two pages of ink. The RFID is expensive, unnecessary and fosters sloppiness in the assessment process.

No less important, we citizens who travel must avoid a spectrum of miscreants ranging from cheating cabdrivers through pickpockets and robbers, all the way to terrorists. I don't expect my country to actively protect me when I am abroad, but I do expect it to not put me actively in harm's way.

I don't need a beacon that is an advertisement for my potential victimhood, "Look, over here, an American! Need cash? Credit cards? Want to make a splashy political statement for the news? Act now!"

It is true that there are countermeasures for these passport tracking bugs.

The Office of Management and Budget plans to test how easy it is to read the RFIDs from various distances. There are discussions of how to make radio-shielded passport covers. Shielding itself is a simple enough technology that the difficulty will be only in how to make passport shielding that doesn't also set off the metal detectors.

However, this brings us back to appropriate technologies. Two-dimensional barcodes can carry the same information that an RFID tag can. They can be easily, reliably, quickly scanned. The cost per passport is only paper and ink. They don't break when sat on. There is no way to suborn a passport at a distance. It is the obvious correct solution from a standpoint of cost, reliability and safety.

The present proposal for RFID tags in passports is so obviously wrong that some other security experts have suggested outright malice in this proposal.

I don't believe that. I see nothing but smart people being blinded by clever technology into doing something stupid. Let's hope the State Department comes to its senses before the stars in its eyes get Americans robbed and killed.

First published on April 24, 2005 at 12:00 am
Jon Callas, an internationally recognized security expert, is the chief technical officer of Palo Alto, Calif.-based PGP Corp. (www.pgp.com).
EmailEmail
PrintPrint