Bruce Schneier

 
 

Schneier on Security

A blog covering security and security technology.

« Aerial Surveillance to Detect Building Code Violations | Main | The Legacy of DES »

October 04, 2004

RFID Passports

Since the terrorist attacks of 2001, the Bush administration--specifically, the Department of Homeland Security--has wanted the world to agree on a standard for machine-readable passports. Countries whose citizens currently do not have visa requirements to enter the United States will have to issue passports that conform to the standard or risk losing their nonvisa status.

These future passports, currently being tested, will include an embedded computer chip. This chip will allow the passport to contain much more information than a simple machine-readable character font, and will allow passport officials to quickly and easily read that information. That is a reasonable requirement and a good idea for bringing passport technology into the 21st century.

But the Bush administration is advocating radio frequency identification (RFID) chips for both U.S. and foreign passports, and that's a very bad thing.

These chips are like smart cards, but they can be read from a distance. A receiving device can "talk" to the chip remotely, without any need for physical contact, and get whatever information is on it. Passport officials envision being able to download the information on the chip simply by bringing it within a few centimeters of an electronic reader.

Unfortunately, RFID chips can be read by any reader, not just the ones at passport control. The upshot of this is that travelers carrying around RFID passports are broadcasting their identity.

Think about what that means for a minute. It means that passport holders are continuously broadcasting their name, nationality, age, address and whatever else is on the RFID chip. It means that anyone with a reader can learn that information, without the passport holder's knowledge or consent. It means that pickpockets, kidnappers and terrorists can easily--and surreptitiously--pick Americans or nationals of other participating countries out of a crowd.

It is a clear threat to both privacy and personal safety, and quite simply, that is why it is bad idea. Proponents of the system claim that the chips can be read only from within a distance of a few centimeters, so there is no potential for abuse. This is a spectacularly naïve claim. All wireless protocols can work at much longer ranges than specified. In tests, RFID chips have been read by receivers 20 meters away. Improvements in technology are inevitable.

Security is always a trade-off. If the benefits of RFID outweighed the risks, then maybe it would be worth it. Certainly, there isn't a significant benefit when people present their passport to a customs official. If that customs official is going to take the passport and bring it near a reader, why can't he go those extra few centimeters that a contact chip--one the reader must actually touch--would require?

The Bush administration is deliberately choosing a less secure technology without justification. If there were a good offsetting reason to choose that technology over a contact chip, then the choice might make sense.

Unfortunately, there is only one possible reason: The administration wants surreptitious access themselves. It wants to be able to identify people in crowds. It wants to surreptitiously pick out the Americans, and pick out the foreigners. It wants to do the very thing that it insists, despite demonstrations to the contrary, can't be done.

Normally I am very careful before I ascribe such sinister motives to a government agency. Incompetence is the norm, and malevolence is much rarer. But this seems like a clear case of the Bush administration putting its own interests above the security and privacy of its citizens, and then lying about it.


This article originally appeared in the 4 October 2004 edition of the International Herald Tribune.

Posted on October 04, 2004 at 07:20 PM32 CommentsView Blog Reactions

To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.

Comments

Thanks for the article "The Security of RFID Passports"!

If one must scan the passport with an optical reader in order to
obtain the key with which to decrypt the RFID information, then
what's the point of using RFID? The only benefit RFID provides over a
contact chip is the ability to read the card at a distance (and
presumably some additional reliability, although I doubt that even
the most frequent user will approach the use of a smart credit card).

Furthermore, once they're required to optically scan the passport,
then it seems that they may as well encode all the data optically.
The only advantage of RFID there is possibly greater storage
capacity, something a contact chip could provide. (Although, as far
as I know, RFID systems hold very little data).

Finally, there are at least two classes of RFID: those that avoid
collisions and those that don't. A passport that must be held by hand
an optically scanned can use the latter of these, and not require any
collision-avoidance data.

Many of these points are moot, of course, if the State Department's
ulterior motive is the ability to read passports at a distance...

Posted by: Rick at November 17, 2005 06:54 PM


Sorry, Bruce!
I first sent previous comment, and then understood, WHO is this blog's owner :)

Posted by: Leo at November 19, 2005 02:47 PM


tyyyut

Posted by: ouoiu at December 21, 2005 09:28 AM


è·‘è·‘
街头篮�
世界�精彩进�美女
洛奇圣骑战争
金泰熙
我们结婚�
视频
短片
游�
情书

Posted by: sss at July 12, 2006 12:52 AM


I do not agree to these views. I have been working on RFID since a couple of years.Though security is still an issue, the reader has to be in close proximity to the passport to read the contents of the tag.Also , the information on the passport is anyway with the govenment authorities of the country that you are trying to enter.

Posted by: Dhaval at August 11, 2006 02:15 PM


Related Pages in AI Topics: General Index by Topic to AI in the news ... World chess champion Vladimir Kramnik defends tenaciously to draw computer Deep ...

Posted by: tarst at December 6, 2006 12:32 PM


Sounds like some of the folks are missing the point. There is no doubt that new technology will make RFID readers much more sensitive and increase the ability to read RFIDs from a distance. Also, current (commercial readers) are not designed to be sensitive. Now imagine that Homeland "Security" or Al Qaeda wanted to develop a RFID reader that would work over longer distances....I'm sure it would be very possible.

My biggest concern is being overseas and being remotely identified as American. Just imagine the possibilities for terrorism and surveillance. You could build a bomb that wouldn't go off until a certain number of American's were in the area. You could plant small mines or other explosive devices that would go off if an American walked by. You could place a sensor near a sidewalk and identify Americans for kidnapping. From reading Mr. Schneier's post, it appears remote identification is possible.

I have to get a new passport. If I get one of the new RFID versions (the system is not yet setup to give everyone the new passport) I'm going to make myself a small, light, faraday cage (that will fit within a pocket) to store the passport in while I have the passport in my possession.

Posted by: lownslowav8r at January 3, 2007 02:40 PM


I agree with lownslowav8r; in that being singled out, or being identified as an American, would be a great concern we would have to deal with. If our own government can identify things about us, such as medical or personal information about us, then there is no telling who else can do the same thing!! Too dangerous!

Posted by: Confused American at April 1, 2007 12:15 PM


Hey guys! theres a Company called paraben that makes a cover for your passport. i was told of it late last year. i was thinking it was a joke and finally purchased one for 19.95 in march 07 after getting it i tried many things to prove this thing "fake" but it really works really good! it not kept signals from the passport inside the cover i also put my cellphone in there on speakerphone in a conversation. as soon as i put it inside my phone lost its connection and i tried to call my phone but it would not ring! as soon as i took my phone out it regained the full signal and began to ring! give it a try. im going overseas on april 19th and i feel alot better now going!

Posted by: keith at April 16, 2007 05:12 PM


"And he causeth all, both small and great, rich and poor, free and bond, to recieve a mark in their right hand, or in their forehead: And that no man might buy or sell save he had the mark."
--Revelation 13:16

Hilter used the barcode on people in Nazi Germany, the mark of the beast of now is the RFID chip. Bush Sr. spoke of a new world order during his presidency and it has continued to be a rising threat. The laws of opening borders are already in motion. Prepare for the future now...DO NOT ACCEPT implantation...Research what has been forewarned in many religions and Sumerian Artifacts, don't stop until you are aware of the dangers that threaten us all. Ignorance is NOT bliss.

Posted by: shoshe at May 9, 2007 01:51 PM


I agree with shoshe.
DO NOT ACCEPT implantation........
.....don't stop until you ar aware of the dangers that threaten us all. Ignorance is NOT bliss

Posted by: wendela at May 10, 2007 08:10 AM


tell me if im wrong!? to turn the idea around: apart from only reading the RFID chip, i guess it is also possible to create an chip with a fake identity "maybe buy it in thailand". As an terrorist u can carry a clean signal with you around? it kind of makes you invisible in crowds..

Posted by: melek at May 31, 2007 10:21 AM


Does anyone know an easy way to disable the RFID chip in passport or other ducuments? (5-10 seconds in the microwave possibly?). It would seem that a shadow business of disabling the chips so it looks like malfunction might be a good defnese against identity theft or other nefarious attempts to read passport chips.

Posted by: Stanton at June 7, 2007 06:27 AM


I am not a religious person by any means. However, it is just un natural and a large coincidence that this stuff appears in many religious scriptures. If this rfid chip does get implanted in passports and in humans, we will be sitting ducks. We will have no choice but to comply to everything we are told. It could be a way to possible control humans or population. Anyone see that movie w/Denzel Washington- Manchurian Candidate??

Lets not be sitting ducks, fight for our rights. Say no to RFID chips.

Posted by: Nicole at June 14, 2007 10:09 PM


man i knew it was coming the fact that 9/11 was an inside job and these chips coming as a result of "better security" doesn't suprise me in the words of BOB MARLEY stand up for your rights,don't give up the fight....

Posted by: cleo at August 4, 2007 01:13 AM


We have RFID chips, mind control towers (supposedly cell towers), Federal Reserve quacks, chemtrails, NWO, terrorists, a corrupt government, cameras everywhere you go (even in toilets), and so much more then can be mentioned here. When are people going to wake up and take action to stop this crap...We seem to do whatever we're told to do walking blindly like a herd of cattle towards doom. If "we the people" don't take action soon it'll be too late.

Posted by: Missy at August 14, 2007 03:44 PM


I agree with the last few comments. It's scary what's happening to our freedoms and this world is turning into some version of Orwell's 1984. Know that we the people,are strong and powerful and that is why the need to control us is so great-so the much smaller elite class can keep achieving their agendas. We must fight. Everyone go to www.zeitgeistmovie.com and get fired up about this!

Posted by: kate at September 2, 2007 11:10 AM


The information about the individual is not stored on the chip. What the chip contains is a serial number which is used by the database to lookup the records which conatin personal information, which already exist inside your credit card company, the government records involving your SS, income, etc, and in your Insurance claims. It is not possible to take personal information from the chip itself, the database must be hacked. This is a threat, but it has been a threat since the digitization of record keeping, meaning that there is not any significantly larger danger now that the serials are used to identify a person on the RFID tags.

Posted by: system at September 5, 2007 08:56 PM


I have done a lot of research on this, as I believe a family member has these in his body. They are being used for mind control. If you do not believe this check: www.secretangel.tv website. America is called the "Land of the Free"????? Not any more!!! We are at present consulting a attorney who is also a MD. I believe there are a lot more people out there who suffer from this.

Posted by: bixbabe44 at September 16, 2007 07:36 AM


You see the problem with these RFID chips is the potential of what they could be used for in the not too distant future... whilst they only hold a "serial code" to access a database, it should be noted that that in itself is plenty enough to allow them to be used for numerous things far more controlliing than many would want to believe possible.

Imagine them replacing your debit/credit card... you go to pay for something and they scan your implanted RFID to allow access to your personal bank accounts etc.... hmmmm... Its the database that matters, not whats stored on the card. One world government, one world bank... one central controlling force of the entire population... Sound scary? It really could happen.

RFID is seriously bad news.

Posted by: G at September 30, 2007 04:44 PM


Barcodes is the "666"
It was said in many religions including the last Chapter of the Christian Bible way over a thousand years before any of this NOT to take "the mark of the Beast". (Shoshe)
Why some people think of this as Secure? I am not American but a One world government... It is a world problem.
What ever they say, they kind of forget that we are still Human beings NOT computers!!! (humans come from nature - invented the computer and we can destroy it too).
Work and society is controlling enough, why exept government control. And what if the chip gets hacked (system at) We don't wanto live in your system!
God has already given us the gift of Free will and it can never be taken from us.
This is a time where us Humans have to realize our own power and when we do that, no one can take our Liberty.

Posted by: Anonymous at October 19, 2007 07:17 AM


What about electropollution

Electromagnetic frequencies (EMF) and electromagnetic radiation (EMR) that comes from batteries, radios, computers, cellphones, microwaves AND PROBABLY THE RFID CHIP TOO - if it plugs, plays, runs or opperates on batteries and even wireless - can you just imagine the RFID chip inplanted into your body...
BAD idea!!! Your health is probably at RISK as well... (radiation causes CANCER!)

Posted by: Gee neva thought about that one... at October 19, 2007 07:43 AM


The nation and world is much more powerfull than the government!

Posted by: fat cat at October 19, 2007 07:54 AM


QUOTE:"Hilter used the barcode on people in Nazi Germany"

Absurd! The "barcode" wasn't even invented yet! The Nazi's tattooed a number on the wrist - not a barcode.

What nonsense. If you don't like the idea say so - but inventing crap like this is counter-productive. There is no plan to "implant" RFID chips into people without their consent!

Posted by: Bruce at November 3, 2007 04:18 PM


I think this is all very scary and people need to wake up.
There is such a huge control on us already it seems so hard to change but it must be possible.
The Government are so clever, they will have people actually wanting the chips put inside them, thinking they will need them for there own protection.
People have to be aware. Please everyone watch www.zeitgeistmovie.com. Then try and get as many people who are followers of there government to watch it. Maybe then when we are all advised or made to have chips put inside us people who before would have asked no questions might start to think a bit more. Things have to change. We deserve better.

Posted by: Anonymous at November 5, 2007 10:00 AM


Uh, hate to burst your bubble. But 'teh terraists' should have no trouble picking americans out of a crowd in foreign countries without resorting to constructing a rube-goldberg-esque plot using as yet not invented RFID tech. We are very distinctive when we go abroad.

Why would they go through the expense and trouble to invent some sort of device to scan people's passport's from a distance when they can just strap a bomb to a fanatic and blow up any tourist attraction with obnoxious folks wearing fanny packs crowded around it?

Posted by: JM at December 12, 2007 10:53 AM


For Bruce, to correct your comment, the idea of the barcode began in 1932 and began implementation measures in 1948. There may not be an idea to implant people against their will, but what if that was the only means of accessing your accounts and other information. Behind that idea would be to create something that seems ideal to the average person, more convenient (because we love convenience), and readily accessible. We lose driver license, credit cards, and other personal information all the time. What if banking institutions made it seem as though it would be more beneficial for them not to have clients that lost information and gave incentives for those with RFID chips...What if paper currency was not widely accepted as it is now? This may be thinking outside of the box and there may not be a sign of that happening any time soon, but just what if? It would not be force to say that it would be in your "best interest" to get it, or to be able to function as you do now.

Posted by: infoforyou at December 16, 2007 02:11 AM


Being ignorant to something that has been fortold by God to him be the Glory. We are living in the last days were men will be deceiving and being deceive, this chip is becoming a convience to the world to save money, to protect your idenity, and to know terrorist from a non-terrorist and ultimately buy and sell and get medical care. The times are evident of the evil powers that are in the world causing these events to happend bringing in this one world unity we called globallization, the devil will use his old tricks and that is use ourselves our action and our decisions against us and cause us to believe a lie before the truth. Remember this it is written in the Bible "for we are not dealing with flesh and blood but principalities,rulers in dark places, evil spirits".

Posted by: godknows at January 23, 2008 09:37 PM


QUOTE "I do not agree to these views. I have been working on RFID since a couple of years.Though security is still an issue, the reader has to be in close proximity to the passport to read the contents of the tag.Also , the information on the passport is anyway with the govenment authorities of the country that you are trying to enter."

Thanks, there is absolutely no reason and no advantage to having a tracking chip in your passport. You go through the same customs line and can just as easily swipe a magnetic card. The chip is there to track you. At home, or abroad. WAKE UP. Read "The History of Inflation" to find out what kind of people come to power after the destruction of a national currency. Read about Stalin's Russia, Hitler's Germany, and you'll probably realize Mike "Stalin" Chertoff's true agenda. When you trade freedom for anything you get slavery. The opposite of freedom is not safety, you can't trade it for safety. WAKE UP.

Posted by: libertea1776 at March 17, 2008 06:21 PM


so you made this original post in 2004 and that meansthat in the past 4 years the goverments has had the chance to put these devicies in...have they.............is that constitutional and doesnt the Bush administration have to go through thoe other checks and balences

Posted by: Chi at March 26, 2008 09:12 PM


Today was the day that I was 'chipped' by the government. At port facilities around the nation people are walking into offices set up by the government and the TSA (Transportation Security Administration) to be screened for receiving a TWIC card. (Transportation Worker Identification Credential) the authority for collecting this information and to conduct a security threat assessment is 49 U.S.C.114, 40113, and 5103a. This is perfectly legal and is in coordination with the USCG and TSA. To begin with this will cover those persons who are required to enter secured areas at port facilities/ vessels.
My understanding is that this will eventually become a national ID card, it has a photo, barcode, your fingerprint and yes.. inside is a chip.
Do I think this will damn my soul to eternal flame?
Is this in anyway going to make accessing my personal information easier to some nefarious crimminals out there?
No to both questions.
Is my banking on there or anything that has to do with my finances?
Nope..
There isn't anything on there that couldn't be easily be found out by taking the time and searching.
It just says, 'Hey! this guy is a good guy, go look for terrorists, as yes 'crimminals' elsewhere.
Oh by the way.. something you all should know, when it comes your way if you are a crimminal, have a warrant out for you, an attachment, didn't pay your back child support, or are an illegal alien... 'click, click' yer outta here!!!

There is no more running, because there is soon no place to hide.

Posted by: Chipped at April 1, 2008 06:38 PM


Just got my passport. I'm upping my donation to the ACLU.

Posted by: Anonymous at April 24, 2008 06:18 PM


Post a comment



Real names aren't required, but please give us something to call you. Conversations among several people called "Anonymous" get too confusing.



E-mail is optional and will not be displayed on the site.


Remember Me?


Powered by Movable Type 3.2. Photo at top by Steve Woit.

Schneier.com is a personal website. Opinions expressed are not necessarily those of BT Counterpane.

 
Bruce Schneier