RFID e-passports

Back from a slight posting hiatus (library construction, planning to move half way across the country, etc), I’ve been hearing a story that I think is worth exploring. There’s been quite the buzz in news and blogs that the US Department will begin issuing passports embedded with RFID tags in October.

There has been confusion mixed with equal parts controversy regarding whether the e-passports will have RFID tags or something called an ISO 14443 chip. RFID systems pretty much consist of RFID chips (also sometimes called tag or smart card) and a reader. RFID tags can be passive or active. Passive tags are powered by the readers, while active cards have their own power.

RFID are commonly used for tracking supply chains (such as WalMart). RFID has seem some adoption by libraries, although this has certainly been tempered due to cost of implementing the system. The e-passports will have a type of RFID tag that is passive and uses the ISO 14443 chip. This chip can be encrypted, but it doesn't have to be. The State Department does not plan to encrypt the chips used in the passports.

Public outcry is largely centered around the fear that these e-passports will be able to be read from a great distance. Some say 10 or 30 feet – although this distance could certainly be open to debate. Stoking the fire, Luke Grunwald – a German security expert – demonstrated how personal information from an e-passport could be copied and transferred.

In response to concerns, The State Department will:

"...include an anti-skimming material in the front cover and spine of the electronic passport that will mitigate the threat of skimming from distances beyond the ten centimeters prescribed by the ISO 14443 technology, as long as the passport book is closed or nearly closed." [Source]

Could the data stolen off an e-passport could identify American citizens in other countries? Could it lead to identity theft? This whole issue is certainly worth hashing out before October rolls around.