Chipping Away Your Privacy
“The future is here. It’s just not widely distributed yet.” - William Gibson
January 15, 2008
by Rob Lafferty
If your passport is less than one year old, the future has certainly arrived for you. Implanted in all US passports after October of 2006 is a tiny radio frequency identification (RFID) chip that can transmit your name, nationality, sex, date and place of birth along with your digitized photograph. If the improperly named Department of Homeland Security (DHS) has its way and it probably will that data will soon include fingerprints and iris scans as well.
Unless a rising wave of discontent from individual states prevails, your driver's license in the future will hold much of the same information. On March 9, 2007, DHS announced “minimum standards for State-issued driver’s licenses and identification cards that Federal agencies would accept for official purposes after May 11, 2008, in accordance with the REAL ID Act of 2005. The law requires the use of a REAL ID for Federal purposes such as accessing Federal facilities, boarding Federally-regulated commercial aircraft, or entering nuclear power plants. "
That's not all the folks at DHS have in mind for their digital monitoring system. Once the law takes effect, Americans will need a REAL ID not just to travel on an airplane, but also to open a bank account, collect Social Security payments or make use of almost any federal government service. DHS also insists that all Americans who use a driver's license or state ID card must apply for a REAL ID by 2013.
DHS doesn't actually have the authority to create a national identification system. That was spelled out in 2004 by then-DHS Secretary Tom Ridge, who stated, “The legislation that created the Department of Homeland Security was very specific on the question of a national ID card. They said there will be no national ID card.”
The agency has avoided that restriction by insisting that each state develop their own cards according to federal guidelines. Applicants will need to bring a photo ID, birth certificate, proof of Social Security number and proof of residence to the local office of their state's Dept. of Motor Vehicles to obtain a card. Each state must maintain their own databases to store that information and make it instantly available to other states and federal agencies.
If you live in the state of Washington, that future has arrived for you, too, as officials there will issue the first "enhanced drivers license" (EDL) this month. The residents of New York, Arizona and Vermont will soon join them; those states all agreed earlier this month to comply with the new DHS "Western Hemisphere Travel Initiative" that requires either a passport or an EDL for all Americans who travel into Canada and Mexico.
According the DHS, "Enhanced drivers licenses will make it quicker and easier to cross the border back into the United States because they will contain a vicinity RFID chip that will signal a computer to pull up your biographic and biometric data for the officer as you pull up to the border, and a Machine Readable Zone or barcode that the officer can read electronically if RFID isn't available."
The agency goes on to state: "No personally identifiable information will be stored on the card's RFID chip or be transmitted by the card. The card will use a unique identification number that will link to information contained in a secure database. This number will not contain any personal information. When you get an EDL you will also receive information on how to use, carry and protect your license, and a shielded container that will prevent anyone from reading your license."
The deadline for states to implement REAL ID has since been pushed back until Dec. 31, 2009, but that later date won't bring full compliance. Thirty-five states have either passed legislation or are debating new laws that reject the concept of REAL ID cards. A New Hampshire bill described the program as "contrary and repugnant" to the state constitution and the US constitution. Maine refused to participate by a 34-0 vote in the state Senate and by a 137-4 vote in the state House.
A Colorado resolution states that the "war on terror" should not be fought with tools that function "...at the expense of essential civil rights and liberties of citizens of this country." Montana's legislature approved a measure saying, "The state of Montana will not participate in the implementation of the Real ID Act of 2005" and directs the state motor vehicle department "not to implement the provisions."
Hawaii's Sen. Daniel Akaka has publicly stated his opposition to the REAL ID concept as providing "one-stop shopping for identity thieves" and called for its repeal.
"From its inception, REAL ID has been controversial and criticized by both ends of the political spectrum," Akaka said in May of last year. "The Act places a significant unfunded mandate on states and poses a real threat to privacy and civil liberties. To address these concerns, I reintroduced the Identity Security Enhancement Act with Senators Sununu, Leahy, and Tester to repeal REAL ID and replace it with ... the more reasonable guidelines established in the Intelligence Reform and Terrorism Prevention Act of 2004."
RFID use is not new but is growing quickly and spreading into unexpected areas of everyday life. Implants have been available for nearly thirty years as ID tags for livestock, lab animals and family pets. Chips can be found in clothing that monitors heartbeat and blood pressure, in car keys and highway toll tags, in employee ID cards and security access cards. They're used to prevent toilets from overflowing, for timing athletic events and tracking anything from cheese wheels to razor blades to beehives.
Vicinity RFID chips can be read by authorized readers up to 30 feet away. Proximity RFID chips can only be read from a few inches away. Low-cost passive chips are commonly as small as a large grain of rice, but Hitachi now makes one that's just slightly larger than the visible point of a pin.
Security levels vary according to the intended use. Medical implants generally have all data encoded in the chip, while the REAL ID chips will contain only a number used to access a database somewhere else. Stored data is transmitted back to the reader by a method the DHS folks insist is secure yet last year it only took two hours for a Dutch security expert to crack the encryption on a European Union passport implanted with a chip. And as the use of RFID rises, a counterpoint is emerging as some very creative people are working on shielding devices and clothing to block the scanners that read those chips.
Even DHS acknowledges that significant privacy and security risks known as “skimming” and “eavesdropping” exist in conjunction with RFID technology. It's especially true when data is transmitted through a wireless network, which happens each time a chip is scanned. Computer experts have built custom devices that can read chips from up to 70 feet away or steal the data from mid-air as it's being transmitted from chip to scanner.
One device marketed under the name "VeriChip" is a passive RFID tag covered with a special coating that allows it to bond with human tissue and stay right where it was injected into a person's hand or arm. When scanned by a special reader, a tiny antenna in the VeriChip draws power from that signal and sends its data to the reader.
Three years ago Dr. John Halamaka, CIO of Harvard Medical School, was implanted with a VeriChip in order to evaluate it as a potentially life-saving resource for the medical industry. Anyone who scans his arm with the appropriate reader is directed to a website where all of his medical information is kept up to date. Halamaka believes that RFID chips will be especially useful when patients arrive at a hospital unconscious or unresponsive. The only downside he mentions is the need for a design that prevents his chip from triggering store security systems, which has happened to him several times.
Kevin Warwick, a professor of cybernetics at the University of Reading in England, has an implant that allows him to open doors, turn on lights, adjust the heat and access his computer with a wave of his hand. He's now taken the human-machine interaction experiment one level deeper with a second implant that interfaces directly with his nervous system.
At the Baja Beach Club in Barcelona, a VIP guest or club member who wants quick and easy access to the exclusive hangout can have a tag injected into his arm on the premises. The tag will identify patrons when they arrive and function as a debit card linked to their club account.
"We have a special zone at Baja Beach Club where only VIPs are allowed, which has various exclusive services for these members" said club owner Conrad Chase. "We are the first discotheque in the world to offer the VIP VeriChip. Using an integrated microchip, our VIPS can identify themselves and pay for their food and drinks without the need for any kind of document ID."
According to Chase, the use of RFID chips isn't meant just for entry to his beach club. "The objective of this technology is to bring an ID system to a global level that will destroy the need to carry ID documents and credit cards," he said. "The VeriChip we implant in the Baja will not only be for the Baja, but is also useful for any other enterprise that makes use of this technology."
During a television interview last May, Scott Silverman, the chairman of VeriChip Corp., proposed implanting RFID's in immigrant workers at the border as a way of verifying their identities when they arrive at their workplace. "We have talked to many people in Washington about using it," he said.
Silverman isn't the only one who likes the idea of implanting RFID chips in people. According to US Senator Arlen Specter, Colombian President Alvaro Uribe "...said he would consider having Colombian workers have microchips implanted in their bodies before they are permitted to enter the US for seasonal work."
Not everyone agrees. California, Wisconsin and North Dakota have already passed laws that ban employers from forcing people to have RFID devices implanted under their skin. Eleven other states have legislation pending on the same issue.
At this point in the evolution of RFID technology, chips are used primarily for store inventory control and the pricing of items for sale. It's important to remember, however, that RFID chips are made to function as tracking devices. That's their purpose, and you can be certain that's how they will be used in the zero-privacy digital world that awaits us all.