New 'e-passports' raise security issues

Unfortunately, she says, the State Department has gone ahead with the e-passport program despite receiving public comments that were more than 98 percent negative.

The proposal didn't receive the kind of open, public discussion that "I think would have led to more acceptance," says Ms. Albrecht, a privacy expert who has tracked how businesses and government use RFID tags for several years.

The apparel company United Colors of Benetton decided it was going to ship its clothing laced with RFID tags a few years ago, but changed its mind after a consumer boycott began.

"If it's a company, you can choose not to buy their products," Albrecht says. But if you need a passport, you'll have to carry the electronic version, like it or not. "You can't boycott the State Department," she says. "It's not like it's a free market where there's somewhere else to go if you don't like the policy."

As an extra layer of security, the e-passports first have to be touched to a conventional bar code-type scanner, the same kind used at grocery stores and on current passports, before the RFID chip can be read. This Basic Access Control "acts like a PIN number" to guard the chip, Barrett says.

But Steinhardt wonders, then, why bother with the contactless RFID scan? The State Department says the chip can contain more information than a bar code can, such as a digital photo. Some have speculated that it eventually may contain a fingerprint image, an iris scan, or other data as well.

Or does the chip have a more sinister purpose?

The State Department reneged on a promise to the ACLU that it could bring in independent experts to take a close look at the e-passport before it was issued, Steinhardt says. "There's clearly something else that they have in mind here, and we believe that they want the ability to track people without their knowledge," Steinhardt says. "That's the only explanation for why an RFID chip is in this passport."

Others who are familiar with RFID technology say the scenarios cooked up by e-passport opponents are far-fetched.

"A lot of these concerns, when you think about them in the real world, they start to become really silly," says Mark Roberti, editor of the RFID Journal. "Are there some scenarios where you could possibly skim some data? Well, yes, maybe. Anything's possible. But, logically, what's the real threat here?"

Terrorists, he says, have much easier ways to identify and attack Americans abroad than to try to employ e-passports. If they're close enough to skim the chip, they're close enough to read "United States of America" on the passport cover, he says.

"There's a lot of misinformation out there," Barrett says. "There are a lot of different RFID technologies, and we're certainly not using Wal-Mart inventory-tracking technology. It's a whole different technology."

For example, when read, the e-passport generates a random ID number. If someone is trying to track the movement of a passport by repeatedly scanning a chip, they'd get a different ID number each time.

"So they really wouldn't know it was you again," she says. "We really have put a lot of safeguards in place to protect the information that's on that ... chip."

If a government were to misuse the passport chip, say, to identify someone who had attended an antigovernment protest, Mr. Roberti concedes that "I think that is a legitimate concern."

The State Department's handling of the e-passport introduction has been "less than ideal and a negative for the RFID industry," he adds.

But the situation also been instructive. Companies that plan to use RFID tags to carry sensitive information need "to think about what data is on the tag, how it could be abused ... and then address those issues," Roberti says.

Page: 1 | 2