<http://www.iht.com/bin/print_ipub.php?file=/articles/2004/12/22/news/passport.html> U.S. passport privacy: Over and out? By Hiawatha Bray The Boston Globe Thursday, December 23, 2004 It's December 2005 and you're all set for Christmas in Vienna. You have your most fashionable cold-weather gear, right down to Canada's national red maple leaf embroidered on your jacket and backpack, to conceal your American citizenship from hostile denizens of Europe. But your secret isn't really safe. As you stroll through the terminal, you pass a nondescript man with a briefcase. The briefcase contains a powerful radio scanner, and simply by walking past, you've identified yourself as an American. Without laying a finger on you, the man has electronically "skimmed" the data in your passport. Science fiction? The American Civil Liberties Union doesn't think so. Neither does Bruce Schneier, software engineer and author of multiple books on computer security, nor Katherine Albrecht, a privacy activist in Cambridge, Massachusetts. They are all worried about a State Department plan to put radio identification tags in all future U.S. passports, beginning next year. That way, American passport data can be read merely by waving it past a radio detector. But whose radio detector? That's what worries many people. "Somebody can identify you as an American citizen from across the street because of the passport in your back pocket," said Albrecht, founder of a Web site concerned with the matter, spychips.com. "You're a walking target." Nonsense, replies a State Department spokeswoman, Kelly Shannon. "We're going to prevent the unauthorized skimming of the data," Shannon said. The U.S. government thinks the new passports will be harder to forge and easier to verify than the current model, without causing undue risk of identity theft. It is all part of the continuing debate over radio frequency identification systems, also known as RFID. Tags that let people zoom through a highway toll booth contain an RFID chip. Many American pets have them embedded under their skin and the U.S. Food and Drug Administration has approved doing the same for people, to provide reliable medical information to emergency room doctors. But privacy advocates like Albrecht contend that government agencies and big corporations want to embed RFID chips into virtually every product, giving them the ability to track almost every move that people make. The RFID chips contain a tiny bit of information that is transmitted via radio when the chip comes within range of a reading device. The chip could broadcast a simple code number, or it could contain a lot more information, like a traveler's name, nationality and digital photograph. This is what the chips planned for future U.S. passports will do, part of a plan to make the passport system more secure. But according to government documents released by the civil liberties union, early versions of the system allowed detection of personal data by a snoop 30 feet, or 9 meters, away. Shannon, of the State Department, dismissed this research, saying the equipment needed to capture the data was too complex and heavy to be used undercover. That is not much comfort to Schneier, the computer security expert. "Technology only gets better," he said. "It never gets worse." Schneier figures that would-be spies and snoops will find ways to pick up signals from the passport chips. The chips might be made more secure by encrypting the data they contain. That way, it would be useless even if intercepted. But the State Department opposes that idea, because immigration officials in many poor countries cannot afford the necessary decryption gear. "Encryption limits the global interoperability of the passport," said Shannon. Why use a radio-based identity system at all? Smart chips, like those found in some credit cards, are plentiful and cheap, and they don't broadcast. You slide them through a chip reader that instantly scoops up the data. But the International Civil Aviation Organization, which sets global standards for passports, has decided on the use of a "noncontact" technology - another way of saying radio-based identification. So will Americans be stuck with high-tech passports that beam their personal data to all comers? Not necessarily. Turns out there's a simple fix: a passport cover made of aluminum foil. It would form what engineers call a Faraday cage, after Michael Faraday, the 19th-century British physicist who discovered the characteristics of electromagnetic waves. Wrap an RFID chip inside a Faraday cage, and the electromagnetic waves from the chip reader can't get in and activate the chip. The State Department says it may use the principle to give travelers an added sense of security. No, there won't be rolls of aluminum foil included with every passport. Instead, the passport cover may include a network of wires woven into the fabric. Fold the passport shut, and there's your Faraday cage. Even Schneier agrees that a properly shielded passport cover should solve the problem. He wonders why this wasn't included in the original plans for the new passports. "It took a bunch of criticism before they even mentioned it," Schneier said. And he hopes the anti-snooping technology is thoroughly tested before the new passports are introduced next spring. -- ----------------- R. A. Hettinga <mailto: rah@ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'