Travel Security and Function Creep: Thinking about the ePassports in the Long Term

For several years, the U.S. State Department has vigorously pursued plans for RFID enhancement of passports--both for U.S. citizens and visiting nationals. The initial ePassport designs, as described in State Department memoranda, lacked basic privacy protection features, like encryption of information transmitted between the passport and reading devices. This was a problem: Passports carry sensitive information, of course, like birth dates, place of birth, and so forth--precisely the type of information that identity thieves prize.

Last month, USA Today ran an article describing laudable changes in the State Department design. Passports will have radio shielding in their covers, to prevent unwanted scanning when the passport is closed. The data they carry will be encrypted. The decryption key will be printed optically on the passport so that immigration officers--or anyone else reading the passport--must have physical possession of it. These features will go a long way toward protecting the sensitive data on passports. (Note, though, that in some countries, like the Netherlands, this may be insufficient.)

Commentators like Bruce Schneier have given the nod to the new design. But I can't shake off a few lingering concerns. (I credit my colleague Ari Juels, one of the clearest thinkers I know on this topic, and a leader on our research on RFID security and privacy, for helping me clarify the issues.)

Chief among these is function creep. The State Department passport design conforms to a set of guidelines published by an international body called ICAO (the International Civil Aviation Administration). Among other aims, those guidelines seek to "[provide] a path to the use of ePassports to facilitate biometric or e-commerce applications." (See p.22; ePassports are viewed as a possible foundation for a PKI.) If you project into the future, this statement seems to mean that businesses could come to rely on your ePassport for commercial transactions.

The ICAO guidelines don't provide mechanisms for fine-grained access to personal information in the passport. So it is conceivable that travelers may enable others to access information like date of birth and elements of their travel history when they check into a hotel--or buy a pack of chewing gum. They may even reveal their fingerprints: Although the present generation of ePassports in the U.S. will only carry digital images of faces, the ICAO guidelines provide for inclusion of other biometric information. (An ePassport, due to cost and implementation constraints, will likely need to rely on an external computer system to do the fingerprint matching--hence the avenue for presenting the biometric information to the other parties.)

ePassports may well tighten security in ports of entry. I think it would be a good idea for ICAO and the U.S. State Department, however, to think through other intended or possible uses well in advance. In the quest for better travel security, let's not compromise long-term privacy and security in other areas. A careful design of access control to personal information on the passport is a first step.

Post A Comment

Your Name
Your Email	Publish email?: Yes No
Your Blog
Subject
Comment
Verification Word