Special alloy sleeves urged to block hackers?

Jul 12, 2009 By TODD LEWAN , AP National Writer
In this, April 22, 2009 photo, Ari Juels, chief scientist and director for RSA Laboratories, holds a Massachusetts public transportation card with an RFID (radio frequency identification) security chip imbedded in it at the RSA Security Conference in San Francisco. (AP Photo/Marcio Jose Sanchez)

(AP) -- To protect against skimming and eavesdropping attacks, federal and state officials recommend that Americans keep their e-passports tightly shut and store their RFID-tagged passport cards and enhanced driver's licenses in "radio-opaque" sleeves.

That's because experiments have shown that the e-passport begins transmitting some data when opened even a half inch, and chipped passport cards and EDLs can be read from varying distances depending on reader techonology.
The cover of the e-passport booklet contains a metallic sheathing that can diminish the distances travel, presumably hindering unwanted interceptions. Alloy envelopes that come with the PASS cards and driver's licenses do the same, the government says.

The State Department asserts that hackers won't find any practical use for data skimmed from RFID chips embedded in the cards, but "if you don't want the cards read, put them in an attenuation sleeve," says John Brennan, a senior policy adviser at the Office of Consular Affairs.

Gigi Zenk, a spokeswoman for the Washington state Department of Licensing, says the envelope her state offers with the enhanced driver's license "ensures that nothing can scan it at all."

But that wasn't what researchers from the University of Washington and RSA Laboratories, a company in Bedford, Mass., found last year while testing the data security of the cards.

The PASS card "is readable under certain circumstances in a crumpled sleeve," though not in a well maintained sleeve, the researchers wrote in a report.

Another test on the enhanced driver's license demonstrated that even when the sleeve was in pristine condition, a clandestine reader could skim data from the license at a distance of a half yard.

Will Americans consistently keep their enhanced driver's licenses in the protective sleeves and maintain those sleeves in perfect shape - even as driver's licenses are pulled out for countless tasks, from registering in hotels to buying alcohol?

The report's answer: "It is uncertain ... "

And when the sleeves come off, "you're essentially saying to the world, 'Come and read what's in my wallet,'" says Marc Rotenberg, executive director of the Electronic Privacy Information Center in Washington, D.C.

By obliging Americans to use these sleeves, he says, the government has, in effect, shifted the burden of privacy protection to the citizen.

Meanwhile, researchers have raised other red flags.

- In 2006, a mobile security company, Flexilis, conducted an experiment in which the transponder of a partially opened e-passport triggered an explosive planted in a trashcan when a dummy carrying the chipped passport approached the bin. A video of the experiment was shown that year at a security conference.

Flexilis has suggested that the government adopt a dual cover shield and specifically designed RFID tag that would make the e-passport remotely unreadable until it is fully opened.

No changes have been made to the U.S. e-passport in response, according to the State Department.
- Some RFID critics wonder: Could government officials read the microchips in an enhanced driver's license or passport card by scanning people via satellite or through a cell phone tower network?

The short answer is no - because the chips in PASS cards and EDLs are "passive," or batteryless, meaning they rely on the energy of readers to power up. Passive tags are designed to beam information out 30 feet.

However, research is moving forward to make batteries tinier and more powerful, says Ari Juels, director of RSA Laboratories. A "semi-passive" tag that could transmit into the atmosphere when triggered by a reader "may be feasible at some point," he says.

Separately, a system called STAR, that adapts deep-space communications technologies to read passive tags from distances greater than 600 feet, was announced last year by a Los Angeles startup called Mojix, Inc. It uses "smart antennas" and "digital beam forming" to process signals in four dimensions - time, space, frequency and polarization. Mojix, founded by a former NASA scientist, promotes the technology for supply chain management and asset tracking.

©2009 The Associated Press. All rights reserved. This material may not be published, broadcast, rewritten or redistributed.

Explore further: Government wants to make cars talk to each other (Update)

add to favorites email to friend print save as pdf

Related Stories

Chips in official IDs raise privacy fears

Jul 11, 2009

Climbing into his Volvo, outfitted with a Matrics antenna and a Motorola reader he'd bought on eBay for $190, Chris Paget cruised the streets of San Francisco with this objective: To read the identity cards ...

RFID Feared as Possible Terrorist Target

Mar 28, 2007

London's Royal Academy of Engineering suggests that someday a terrorist will be able to read personal details from a distance and set a bomb to go off when a particular person gets within range.

Millions of ePassports issued in Britain

Oct 06, 2006

Britain's Identity and Passport Service said it has issued more than 2.5 million ePassports since the biometric documents were made available in March.

Biometric Passport Control: No Place To Hide

Sep 25, 2007

Siemens is making border crossings in Europe more secure through biometric systems that store individual characteristics such as fingerprints and facial photos on a chip integrated into a passport.

Recommended for you

Facebook awards 'Internet Defense Prize'

2 hours ago

Facebook awarded a $50,000 Internet Defense Prize to a pair of German researchers with a seemingly viable approach to detecting vulnerabilities in Web applications.

HP revenue inches up after years of decline

11 hours ago

Hewlett-Packard on Wednesday reported that its quarterly revenue rose for the first time in three years, nudged by improved computer sales everywhere except Russia and China.

Giant tablets aimed at families

12 hours ago

Costing a little more than an iPad but standing more than twice as tall, a new pair of giant tablets wants families to share cozier group experiences with technology.

Restaurants experimenting with pay-in-advance tickets

14 hours ago

With restaurant patrons increasingly jumping on the Internet to make reservations, some high-end eateries here and across the country are adding a new tech wrinkle: having their clientele pay for their meal in advance using ...

User comments : 9

Adjust slider to filter visible comments by rank

Display comments: newest first

marjon
4 / 5 (1) Jul 12, 2009
Try a stainless steel wallet:
http://www.thinkg...ar/9964/
MorituriMax
2 / 5 (1) Jul 12, 2009
I'll be interested if someone comes up with a wallet that acts like a farraday cage.
physpuppy
5 / 5 (3) Jul 12, 2009
I suppose nowadays it's not enough to wear a tinfoil hat - you need a tinfoil wallet as well!

I like the James-Bondish reference in the article to the test where an explosive went off when a particular passport was opened slightly...

In 2006, a mobile security company, Flexilis, conducted an experiment in which the transponder of a partially opened e-passport triggered an explosive planted in a trashcan when a dummy carrying the chipped passport approached the bin. A video of the experiment was shown that year at a security conference.
waltaugust
5 / 5 (1) Jul 12, 2009
The special alloy sleeves they are talking about are made by Identity Stronghold. They make the sleeve for the US Passport cards, many state enhanced drivers licenses as well as passport books and credit cards. Yes even new credit cards have RFID chips that give out your credit card number and expiration date. You can find them at www.idstronghold.com
x646d63
4 / 5 (1) Jul 12, 2009
I'm seriously considering building an "attenuation sleeve" to live in.
frogz
not rated yet Jul 13, 2009
RFID's are a bad idea, period.
scpsr1
not rated yet Jul 13, 2009
Just don't keep your wallet anywhere near your groin area if you want children.
marjon
not rated yet Jul 13, 2009
How many of you concerned about RFID remove your cell phone battery to keep from being tracked?
jabo
not rated yet Jul 13, 2009
you can smash those rfid chips with a hammer to disable them and officials can still scan the bar code to get the info. just play dumb when they ask you why your passport doesn't 'work'.