Premature Technology--UPDATED

In a Saturday morning editorial in The Washington Post, Bruce Schneier raises an issue that should be getting more attention than it has been. His title lays his point right out on the table: "The ID Chip You Don't Want in Your Passport." The United States, along with Canada and a number of other countries, are updating their passports to take advantage of new technology. They're putting radio-frequency identification (RFID) chips in there. I suppose that might speed up your trip through customs--the customs inspector can simply read the electronic information rather than having to page through the passport itself, find your relevant information, and then read it. Unfortunately, if the customs agent can read it, so can anybody else with a nearby reader. The radio part of that name means the chip can be read at a distance. The passport office claims that the new passports will have some sort of shielding that will protect the chip unless the passport is open and the information will be encrypted, but that may not be enough. Schneier gives us a suggestion of what that can mean.

Your passport information might be read without your knowledge or consent by a government trying to track your movements, a criminal trying to steal your identity or someone just curious about your citizenship.

. . .
The shielding does no good when the passport is open. Travel abroad and you'll notice how often you have to show your passport: at hotels, banks, Internet cafes. Anyone intent on harvesting passport data could set up a reader at one of those places. And although the State Department insists that the chip can be read only by a reader that is inches away, the chips have been read from many feet away.

The other security mechanisms are also vulnerable, and several security researchers have already discovered flaws. One found that he could identify individual chips via unique characteristics of the radio transmissions. Another successfully cloned a chip. The State Department called this a "meaningless stunt," pointing out that the researcher could not read or change the data. But the researcher spent only two weeks trying; the security of your passport has to be strong enough to last 10 years.

This is perhaps the greatest risk. The security mechanisms on your passport chip have to last the lifetime of your passport. It is as ridiculous to think that passport security will remain secure for that long as it would be to think that you won't see another security update for Microsoft Windows in that time.

Once the chips start getting placed into new passports, we'll have no choice but to use them. Starting in January, passports will be necessary to go between the United States and Canada by air or sea (we've got until January 2008 before they're necessary for crossing the border by car), so even more people will need them. If you're considering getting or renewing your passport anytime in the near future, do it soon, before the new policies go into effect. Put off getting a passport chip for as long as you possibly can.

UPDATE--Here are a couple more links that might be helpful. You can visit the U.S. Passport site for more information, and this is their site for the electronic passport. If you want to renew, do it quickly and check to see where your new passport will come from. The Colorado office started issuing them a month ago.