The ID Chip You Don't Want in Your Passport

[kurth]

The ID Chip You Don't Want in Your Passport
By Bruce Schneier
Saturday, September 16, 2006; A21

If you have a passport, now is the time to renew it -- even if it's not set to expire anytime soon. If you don't have a passport and think you might need one, now is the time to get it. In many countries, including the United States, passports will soon be equipped with RFID chips. And you don't want one of these chips in your passport. RFID stands for "radio-frequency identification." Passports with RFID chips store an electronic copy of the passport information: your name, a digitized picture, etc. And in the future, the chip might store fingerprints or digital visas from various countries. By itself, this is no problem. But RFID chips don't have to be plugged in to a reader to operate. Like the chips used for automatic toll collection on roads or automatic fare collection on subways, these chips operate via proximity. The risk to you is the possibility of surreptitious access: Your passport information might be read without your knowledge or consent by a government trying to track your movements, a criminal trying to steal your identity or someone just curious about your citizenship.

At first the State Department belittled those risks, but in response to criticism from experts it has implemented some security features. Passports will come with a shielded cover, making it much harder to read the chip when the passport is closed. And there are now access-control and encryption mechanisms, making it much harder for an unauthorized reader to collect, understand and alter the data. Although those measures help, they don't go far enough. The shielding does no good when the passport is open. Travel abroad and you'll notice how often you have to show your passport: at hotels, banks, Internet cafes. Anyone intent on harvesting passport data could set up a reader at one of those places. And although the State Department insists that the chip can be read only by a reader that is inches away, the chips have been read from many feet away.

The other security mechanisms are also vulnerable, and several security researchers have already discovered flaws. One found that he could identify individual chips via unique characteristics of the radio transmissions. Another successfully cloned a chip. The State Department called this a "meaningless stunt," pointing out that the researcher could not read or change the data. But the researcher spent only two weeks trying; the security of your passport has to be strong enough to last 10 years. This is perhaps the greatest risk. The security mechanisms on your passport chip have to last the lifetime of your passport. It is as ridiculous to think that passport security will remain secure for that long as it would be to think that you won't see another security update for Microsoft Windows in that time. Improvements in antenna technology will certainly increase the distance at which they can be read and might even allow unauthorized readers to penetrate the shielding.

Whatever happens, if you have a passport with an RFID chip, you're stuck. Although popping your passport in the microwave will disable the chip, the shielding will cause all kinds of sparking. And although the United States has said that a nonworking chip will not invalidate a passport, it is unclear if one with a deliberately damaged chip will be honored. The Colorado passport office is already issuing RFID passports, and the State Department expects all U.S. passport offices to be doing so by the end of the year. Many other countries are in the process of changing over. So get a passport before it's too late. With your new passport you can wait another 10 years for an RFID passport, when the technology will be more mature, when we will have a better understanding of the security risks and when there will be other technologies we can use to cut the risks. You don't want to be a guinea pig on this one.

http://www.washingtonpost.com/wp-dyn/content/article/2006/09/15/AR2006091500923.html

[AspenRose]

1. Can you wrap it in aluminum foil?

(honest question)

[bonito]

3. Or sandwich it

between two thin magnets, you know like those advertising things that come with the phone book?

[Kutjara]

5. Aluminum foil would probably have the opposite effect.

It would act as an antenna, boosting the weak signal from the RFID chip and making it easier to read from a distance. Lead would probably act as a better RF damper.

It's inevitable that companies will start marketing 'safety wallets' for passports and other RFID documents, but I'll bet these will be no more useful than the 'anti-microwave' dongles that the hard-of-thinking have been attaching to their cellphones to ward off brain cancer.

[CabalPowered]

19. I would think a lead-lined bag for unexposed film

would do the trick.

[jberryhill]

30. No, any conductive shield - Al foil - will work fine

At the relevant frequency range used in RFID, an aluminum foil wrapper is fine. If you don't want to carry that, then you can use a conductive plastic bag specifically made for this purpose. They ship highway "EZ Pass" units in those bags for the obvious reason (so that they won't register when the mail truck goes through a toll lane).

No, it won't act as an external antenna if it surrounds the unit.

[Phrogman]

31. I'll tear a piece offa this nice hat of mine..

e0m

[Sven77]

2. RFID Privacy Issues and News

http://www.spychips.com

[AX10]

4. Thanks

[diddlysquat]

6. Would it arouse suspicion to renew early?

CAN one renew early?

[Earth_First]

7. Sure, why not.

Who's to say that you didn't launder your passport in the last load of laundry?

[Kutjara]

8. Make sure you actually do launder it, though.

Unless you say you lost your passport (which means you have to go through the hassle of filing a police report), you have to send your old one in with the application. If you send back a pristine passport, claiming it was ruined in the wash, the Passport Office will probably just send the old one back to you. So you really do need to damage it in a plausible way.

For the benefit of Agent Mike, the foregoing is a docudrama post, that in no way advocated the mutilation or destruction of government property. Parts of it have been fictionalized and time compressed for dramatic effect. ;)

[bbgrunt]

24. docudrama!! LOL

[radwriter0555]

11. You go through the lost passport process. Make photocopies of it though

and all its pages and put it in your safe.

[kurth]

15. Actually, you can renew whenever you choose

I've been told there are no hard rules on this as long as you can submit the old passport for them to cancel (and return to you along with the new one).

Many countries require that you have at least 6 months left on your current passport prior to departure, and travel agents always tell people to renew well before this 6-month mark. So, renewing 6 months to a year before expiration is perfectly normal. Earlier than that may - or may not - require a signed explanation (see an example below).

I know one person who on a whim decided that she didn't like her passport photo and renewed her passport 3 years before expiration, and she got a new passport (showing her new hair) without any problems. No explanation, no questions asked. Evidently the government didn't mind getting the extra money from her.

---------------------------------------------------

ADULT PASSPORT RENEWAL - EARLY RENEWAL

SAMPLE OF AN EARLY RENEWAL LETTER

U.S. Passport Agency
<insert street address>

Janary 1, 2006

To Whom It May Concern

I would like to renew my passport early because <pick on of the following reasons, or state your own>:

- I am currently out of visa pages, and due to my frequent travel it would be more convient to get a whole new passport now with the extra pages added.

- I am changing my name on my passport, and since my passport expires soon it would be more convient to get an updated passport at this time.

- I am changing my name on my passport and I would like the name change to appear at the front of my passport on the picture page rather than on one of the amendment pages.

- Due to my frequent travel and entry restrictions on various countries I would like to get my passport up to date now while time permits, as I do not think I will have the opportunity to update my passport later on.

- I would like to renew early at this time in order to receive a non-RFID passport. I prefer to travel on a non-RFID passport until privacy concerns are resolved.

- A reason not listed above (give details).

If you have any question please do not hesitate to contact me at <enter a contact number>

Sincerely,

<sign here>

[formercia]

21. Ultimate cure for RFID:

[soothsayer]

9. 5 secs in the microwave,bye bye chip

[glitch]

20. That;s what I was thinking - problem solved. nt

[Warren DeMontague]

10. If you travel abroad, you give your passport out all the time.

And people could steal the information the old fashioned way, too.

[FILAM23]

17. I travel abroad frequently

I show my passport only to officials at the airport
At the hotel, internet cafes, western union, etc I use my DL

[anarch]

12. what, they're not just going to go ahead and put them in our necks?

I assume that will be the wave of the future...you know, for our own protection and whatnot. Chip in the neck at birth!

[midnight]

14. That's what is going on with SS. cards right now.

It use to be that you did not really need a SS untill you started working. About 20 years ago they wanted all new babies to fill our ss info. before being released from the hospital. They are tracking us with a wide range of data.

[tenshi816]

16. Interesting - that explains something to me.

The American government required my half-American/half-British children to get American passports, despite the fact that they already had British ones. We were told that it was necessary for "national security" and that without American passports, they would no longer be allowed to travel with me to the United States using their British ones. So, last year I had to drag them down to the American Embassy in London to get their American passports.

At the time, the person I was dealing with in the passport section was putting a great deal of pressure on me to apply for Social Security numbers for my sons. I said that it wasn't necessary because chances are they'll never actually live or work in the States, so why should they be required to get an SSN. He had no real answer, but continued to press for it and I continued to decline. I was uncomfortable with it because it's just another way to track American citizens worldwide.

[formercia]

22. and call them up for the Draft

no matter where they live on the Planet.

The Childrens' Crusade

No child left behind.

[tenshi816]

26. Oh, yes, that occurred to me as well.

They'll take my sons over my dead body. It helps that we don't live in the US, but I'm not going to take any chances. If my boys can't be found, they can't be drafted.

[formercia]

29. I agree.

My young son has mild autistic symptoms. Rather than having negative feelings about it, I thank God the military won't accept him.

[rman]

13. ID cards prevent terrorism as licence plates prevent car accidents:

not at all.

[bikebloke]

18. I renewed my early.

Just to avoid the tracking chip. Now I'm good for another 10 years. The country probably won't even exist by then.

[Wiley50]

23. How much does it cost for a passport these days?

And what else do I need
and where do I go to get one?

[bbgrunt]

25. go to the post office. $67, unless you are in a hurry

[OhioChick]

33. $67 is for a renewal......

A first time passport is over $100. (This including passport photos)

[high density]

27. So how much data would an RFID in a passport hold?

If we're talking 128kb then you could have a low res photo and some other data, but I still have to wonder how likely it is that an "evil doer" could capture RFID data from a distance without going through some obvious gymnastics to do so.

I have an RFID chip in my debit card and it's so weak that I have to practically touch it to a receiver before it works. I highly doubt that just by walking around with this chip in my wallet that somebody is going to capture the data on the RFID from a distance through my pants, wallet, and other cards. Granted the passport may have a stronger chip but I hope that those who are designing this have at least half a clue (though obviously I have little trust or respect for our government as it currently is.)

[CarlVK]

28. Thank the Gods my renewal just came in the mail.

[Rosco T.]

32. How to build an RFID-Zapper

https://events.ccc.de/congress/2005/wiki/RFID-Zapper(EN)

[Ferret Annica]

34. Can they be destroyed...

by putting it in the microwave? That was suggested to me as a possible remedy to this problem.