Related topics
  • ,
  • ,
  • ,

Biz travelers howl over US gov RFIDs

Border (in)security

A travel industry group has called on the US government to halt its use of new machinery that remotely reads government issued identification cards at border crossings until the safety of the new system can be better understood.

Monday's call by the Association of Corporate Travel Executives (ACTE) follows similar requests by a chorus of civil liberties and computer researchers. They warn that use of the new long-range radio frequency identification (RFID) scanners could jeopardize the privacy and security of people who pass through US borders.

"ACTE is concerned that unauthorized individuals could either resort to electronic eavesdropping at the border or use similar devices that could extract data from RFID chips at other locations," the group's executive director said in a statement. She asked for the system to be halted pending a comprehensive security review.

In July, researchers with RSA Laboratories and the University of Washington published a paper exposing several risks posed by RFID system used in US passport cards and drivers licenses issued by several states that emit RFID signals. They found the documents were susceptible to cloning, a vulnerability that could allow attackers to assume the identity (at least partially) of others.

The researchers also said it was possible for unauthorized parties to remotely read the RFID information embedded in the documents. Interestingly, drivers licenses issued by Washington state were vulnerable to remote scanning even when placed in protective sleeves, the report found.

The information contained in the documents is at the moment limited to an index number that functions similar to a social security number. But civil liberties groups say it still might be enough to allow the tracking of travelers' whereabouts.

"We think there's a significant risk down the road of people being tracked by these static unique ID numbers," Lee Tien, a senior staff attorney for the Electronic Frontier Foundation, told The Register. "How hard is it to harvest numbers and associate them with people's names?"

According to a recent article in USA Today, the scanning machines are in place at five locations as part of the government's requirement that anyone who crosses the border show government-issued ID. The ID can be read from a distance of 50 feet.

In addition to Washington, New York State is also issuing drivers licenses that embed RFID information that works with the system. ®

Sponsored: New Forrester Research: More attacks on keys and certificates