Travel Tips: RFID Passports (Update)

In a previous post, "RFID Passports and Protection" (March 16, 2006), I discussed the issues with radio frequency identification (RFID) technology to be used in US Passports. There is no consensus on the security of this technology, but the US Government is going ahead with its plan for RFID requirements in US Passports.

Read "RFID passports arrive for Americans" (August 14, 2006) on CNet/News.com for more details.

The Electronic Privacy Information Center (EPIC) has issued its concerns (read the report here in PDF format) about this technology to the Department of Homeland Security. EPIC noted that "personal data contained in hi-tech passports [is] vulnerable to unauthorized access." EPIC also cites the Department of Homeland Security's own report indicating that deficiencies in the scanning process may actually keep guards from focusing on the person entering the country. Security expert, Bruce Schneier, commenting on the same technology proposed for I-94 immigration forms, warns that "travelers carrying around RFID passports are broadcasting their identity."

The Government argues that RFID passports are 'passive'. That is to say, they must be activated by a scanner. Therefore, it continues, no one is simply 'broadcasting' sensitive information. Unfortunately, such a scanner can easily be created and used inappropriately. Recall the clip from my previous post showing the ease of hacking (a Dutch TV show; hacking occurs at about 6:40 in the video; the explanation is that the numbers are sequential and connected to the expiration date).

What to do?
While you may still need to comply with the government regulations, remember that you can still protect yourself from unauthorized access to the sensitive information stored on the chip. In my previous post, I mentioned ways of protecting yourself, including a specially designed wallet or portmanteau or even using duct tape.

For the Government's official position see, US Department of State: The US Electronic Passport.

Tom