Special alloy sleeves urged to block hackers?

Jul 12, 2009 By TODD LEWAN , AP National Writer
In this, April 22, 2009 photo, Ari Juels, chief scientist and director for RSA Laboratories, holds a Massachusetts public transportation card with an RFID (radio frequency identification) security chip imbedded in it at the RSA Security Conference in San Francisco. (AP Photo/Marcio Jose Sanchez)

(AP) -- To protect against skimming and eavesdropping attacks, federal and state officials recommend that Americans keep their e-passports tightly shut and store their RFID-tagged passport cards and enhanced driver's licenses in "radio-opaque" sleeves.

That's because experiments have shown that the e-passport begins transmitting some data when opened even a half inch, and chipped passport cards and EDLs can be read from varying distances depending on reader techonology.
The cover of the e-passport booklet contains a metallic sheathing that can diminish the distances travel, presumably hindering unwanted interceptions. Alloy envelopes that come with the PASS cards and driver's licenses do the same, the government says.

The State Department asserts that hackers won't find any practical use for data skimmed from RFID chips embedded in the cards, but "if you don't want the cards read, put them in an attenuation sleeve," says John Brennan, a senior policy adviser at the Office of Consular Affairs.

Gigi Zenk, a spokeswoman for the Washington state Department of Licensing, says the envelope her state offers with the enhanced driver's license "ensures that nothing can scan it at all."

But that wasn't what researchers from the University of Washington and RSA Laboratories, a company in Bedford, Mass., found last year while testing the data security of the cards.

The PASS card "is readable under certain circumstances in a crumpled sleeve," though not in a well maintained sleeve, the researchers wrote in a report.

Another test on the enhanced driver's license demonstrated that even when the sleeve was in pristine condition, a clandestine reader could skim data from the license at a distance of a half yard.

Will Americans consistently keep their enhanced driver's licenses in the protective sleeves and maintain those sleeves in perfect shape - even as driver's licenses are pulled out for countless tasks, from registering in hotels to buying alcohol?

The report's answer: "It is uncertain ... "

And when the sleeves come off, "you're essentially saying to the world, 'Come and read what's in my wallet,'" says Marc Rotenberg, executive director of the Electronic Privacy Information Center in Washington, D.C.

By obliging Americans to use these sleeves, he says, the government has, in effect, shifted the burden of privacy protection to the citizen.

Meanwhile, researchers have raised other red flags.

- In 2006, a mobile security company, Flexilis, conducted an experiment in which the transponder of a partially opened e-passport triggered an explosive planted in a trashcan when a dummy carrying the chipped passport approached the bin. A video of the experiment was shown that year at a security conference.

Flexilis has suggested that the government adopt a dual cover shield and specifically designed RFID tag that would make the e-passport remotely unreadable until it is fully opened.

No changes have been made to the U.S. e-passport in response, according to the State Department.
- Some RFID critics wonder: Could government officials read the microchips in an enhanced driver's license or passport card by scanning people via satellite or through a cell phone tower network?

The short answer is no - because the chips in PASS cards and EDLs are "passive," or batteryless, meaning they rely on the energy of readers to power up. Passive tags are designed to beam information out 30 feet.

However, research is moving forward to make batteries tinier and more powerful, says Ari Juels, director of RSA Laboratories. A "semi-passive" tag that could transmit into the atmosphere when triggered by a reader "may be feasible at some point," he says.

Separately, a system called STAR, that adapts deep-space communications technologies to read passive tags from distances greater than 600 feet, was announced last year by a Los Angeles startup called Mojix, Inc. It uses "smart antennas" and "digital beam forming" to process signals in four dimensions - time, space, frequency and polarization. Mojix, founded by a former NASA scientist, promotes the technology for supply chain management and asset tracking.

©2009 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

Explore further: For Google's self-driving cars, learning to deal with the bizarre is essential

add to favorites email to friend print save as pdf

Related Stories

Chips in official IDs raise privacy fears

Jul 11, 2009

Climbing into his Volvo, outfitted with a Matrics antenna and a Motorola reader he'd bought on eBay for $190, Chris Paget cruised the streets of San Francisco with this objective: To read the identity cards ...

RFID Feared as Possible Terrorist Target

Mar 28, 2007

London's Royal Academy of Engineering suggests that someday a terrorist will be able to read personal details from a distance and set a bomb to go off when a particular person gets within range.

Millions of ePassports issued in Britain

Oct 06, 2006

Britain's Identity and Passport Service said it has issued more than 2.5 million ePassports since the biometric documents were made available in March.

Biometric Passport Control: No Place To Hide

Sep 25, 2007

Siemens is making border crossings in Europe more secure through biometric systems that store individual characteristics such as fingerprints and facial photos on a chip integrated into a passport.

Recommended for you

Bluetooth may be the key to your future smart home

Nov 25, 2014

If you've ever considered trying to turn your house into a smart home, you've likely found the prospect expensive or technologically intimidating. That situation could soon change, thanks in part to an old ...

Self-driving cars could be the answer to congested roads

Nov 24, 2014

If cars with drivers still suffer under gridlock conditions on roads, how will driverless cars fare any better? With greater computerisation and network awareness, driverless cars may be the answer to growing ...

User comments : 9

Adjust slider to filter visible comments by rank

Display comments: newest first

marjon
4 / 5 (1) Jul 12, 2009
Try a stainless steel wallet:
http://www.thinkg...ar/9964/
MorituriMax
2 / 5 (1) Jul 12, 2009
I'll be interested if someone comes up with a wallet that acts like a farraday cage.
physpuppy
5 / 5 (3) Jul 12, 2009
I suppose nowadays it's not enough to wear a tinfoil hat - you need a tinfoil wallet as well!

I like the James-Bondish reference in the article to the test where an explosive went off when a particular passport was opened slightly...

In 2006, a mobile security company, Flexilis, conducted an experiment in which the transponder of a partially opened e-passport triggered an explosive planted in a trashcan when a dummy carrying the chipped passport approached the bin. A video of the experiment was shown that year at a security conference.
waltaugust
5 / 5 (1) Jul 12, 2009
The special alloy sleeves they are talking about are made by Identity Stronghold. They make the sleeve for the US Passport cards, many state enhanced drivers licenses as well as passport books and credit cards. Yes even new credit cards have RFID chips that give out your credit card number and expiration date. You can find them at www.idstronghold.com
x646d63
4 / 5 (1) Jul 12, 2009
I'm seriously considering building an "attenuation sleeve" to live in.
frogz
not rated yet Jul 13, 2009
RFID's are a bad idea, period.
scpsr1
not rated yet Jul 13, 2009
Just don't keep your wallet anywhere near your groin area if you want children.
marjon
not rated yet Jul 13, 2009
How many of you concerned about RFID remove your cell phone battery to keep from being tracked?
jabo
not rated yet Jul 13, 2009
you can smash those rfid chips with a hammer to disable them and officials can still scan the bar code to get the info. just play dumb when they ask you why your passport doesn't 'work'.

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.