State Department’s RFID passport proposal gets complex

I read a story on Wired News’ Web site (see link below) about changes the U.S. Department of State is making to its proposal for RFID chip-embedded passports after privacy advocates demonstrated that RFID chips could be read at distances of 30 feet or more. According to the story, the government agency had claimed that the chips could only be read if they were no more than 10 centimeters (about 4 inches) from the reader.

Those opposed to the RFID-enabled passports claimed that terrorists and criminals could easily identify tourists and Americans by surreptitiously reading the chips on their passports from a distance. After Barry Steinhardt, director of the Technology and Liberty Program for the American Civil Liberties Union, demonstrated a chip being read from 2 to 3 feet away at the recent Computers, Freedom and Privacy conference, the State Department announced it would look once again at Basic Access Control (BAC), a privacy technology it had originally rejected.

According to the story, BAC would protect the RFID chip from being read by unauthorized people:

“The data on a passport would be stored on an RFID chip in the passport’s back folder, but the data would be locked and unavailable to any reader that doesn’t know a secret key or password to unlock the data. To obtain the key, a passport officer would need to physically scan the machine-readable text that’s printed on the passport page beneath the photo (this usually includes date of birth, passport number and expiration date). The reader would then hash the data to create a unique key that could be used to authenticate the reader and unlock the data on the RFID chip.”

Does anyone else think that this is a Rube Goldberg (http://www.rube-goldberg.com/html/gallery.htm) design for a passport?

The idea behind using RFID technology is to be able to read the data from the chip when it is in proximity to the reader. No need to position the chip “correctly,” no need to touch the reader with the chip, no need to actually remove the chip from your pocket, purse or backpack. But now, in order to protect the data on the RFID chip, the chip’s holder (the passport) will need to be properly positioned in contact with a reader in order to create a key, which can then be used to decode the data on the chip.

Why not just put the data on a magstripe or other directly readable medium and do away with the RFID chip entirely?

RFID has been, unfairly in my view, tagged as a privacy-destroying technology, which some future Big Brother society will use to control the populace. It’s time to put the technology on the back burner for a while, at least as far as personal data is concerned, until the ranting has died down and the technology can be viewed objectively. It would be better to simplify both access to and protection for the personal data. What do you think?