Smart Card Alliance Criticizes Passport Card PlansSmart Card Alliance Criticizes Passport Card Plans

A group that promotes the adoption of smart card technology is urging the federal government to reconsider the use of RFID chips for passport cards.

The U.S. Department of State has proposed using cards containing RFID chips for people traveling in and out of areas, such as Mexico, Canada and the Caribbean, where passports have not previously been required.

The Smart Card Alliance, whose members provide ISO/IEC 14443-based contactless smart card and RFID products, said its members believe the vicinity read RFID (or ISO/IEC 18000-6 Type C) technology proposed by the government "is the wrong technology to implement a secure identification to implement in a secure identification card."

"RFID tag technology that was designed to track packages and products is not the appropriate technology to use for securing human identification systems," the group said through a prepared statement.

The government is using Smart Card Alliance-supported (ISO/IEC 14443) contactless technology in e-passports, but the State Department proposed vicinity-read RFID cards to speed travel across borders in the western hemisphere.

The alliance issued a statement in response to the State Department's notice of the proposal, which appeared in the Federal Register in October. The group issued another public statement Wednesday.

"We urge the State Department and Department of Homeland Security to reconsider this decision in favor of more secure 'proximity' contactless smart card technology for the passport card," Randy Vanderhoof, executive director of the Smart Card Alliance, said in the statement.

"Long-range RFID tag technology is used typically to track products, while contactless smart-card technology is already in place at the border to validate the identities of travelers with ePassports." He continued, "Contactless smart card technology has also been recommended by [the National Institute of Standards and Technology] for more than 10 million government employee and contractor identification cards that began to be issued last month."

Smart cards contain microprocessors allowing for improved encryption, authentication and other security measures compared with RFID chips, which send unique identifiers through radio waves.

The alliance argues that the RFID technology would not protect people's information and will not allow border inspectors to verify the authenticity of the cards. So, someone with a reader could follow a person crossing a border, obtain the identification number, duplicate the card and give it to someone resembling the victim. The group said that the card's weaker cryptographic protections and longer-range reading would also likely raise concerns among users that the cards could be used for tracking people.

Requiring a second type of technology for cards scanned at borders would also require investments for new readers, networks and databases, the alliance pointed out. Because the system would send, read and verify identifying information in real-time, the process would be vulnerable to radio frequency interference or disruption of network communications.

The group argues that DHS would not increase efficiency with vicinity read cards as it claims, because cars would have to stop for verification after officers read the cards read from a distance. The Smart Card Alliance also criticized the federal government for failing to hold open discussions about the proposal.

"The U.S. government selection of vicinity-read RFID technology for the proposed passport card puts border crossing throughput as the primary goal, at the expense of information security and citizen privacy and while not actually materially improving throughput if border security is to be improved," the alliance stated.

The alliance is urging the government to use contactless cards for increased security and to save money by using the same infrastructure required for ePassports.

"The U.S. government needs to focus on a policy for efficient border crossing that increases border security and citizen privacy," said Neville Pattinson, co-chair of the Smart Card Alliance Identity Council. "The necessary technology is readily available to back up such a policy. Contactless smart card technology, compatible to that already being used globally in electronic passports, possesses all the security features necessary to protect citizen privacy, whilst upholding all operational parameters at the land border check points."

Tres Wiley, director of eDocuments for Texas Instruments, which provides both vicinity and proximity technologies said the company supports the Smart Card Alliance's conclusions.

"The vicinity technology proposed by the U.S. government was not intended or designed for sensitive ID application," he said.