EnRUPT – The Simpler The Better

Let's not forget that the chips in the “passcard” and the enhanced drivers licenses were never meant to be used to identify people, but rather to replace barcodes on chewing gum and other items. While the passports can only be read from a few centimetres and only when the passport is open, the UHF chips on these new drivers licenses can be read from many metres away without any user’s consent.

The introduction of UHF chips on identification documents escalates the privacy and security discussion to a whole new level. So far we have been debating whether systems provided the level of protection intended by their designers. Some systems like passports stood up to this scrutiny better than others such as subway passes. But at least some level of security was intended.

Now we are looking at a system where apparently no thought was given to security whatsoever, and where people are tagged like chewing gum, just so they can be easily recognized, sorted, and processed faster at the border or anywhere else.

The fundamental problem going on here is that nobody is building a threat model when they choose to implement these new technologies. Decision makers listen to marketing hype put out by RFID vendors who claim that magstripe or bar coded driver's licenses are not secure, and fail to point out that they cannot be read from or written to without PHYSICALLY HAVING THE CARD IN YOUR HAND. This, of course, is not an issue for RFID based ID Cards. Given the right tools, one can covertly read from and write to RFID Driver Licenses without detection. The claim that the RFID card simply contains a meningless number is insanity at its finest. Is my Social Security Number also meaningless? Would anyone like someone to be able to read your Social Security Number and write it to their own card?

Honestly, I cannot imagine that these people are truly this clueless about the issues here.