See other Dead Constitution Articles
Title: DHS Privacy Committee Finalizes Report on RFID IDs
Source:
RFID Journal
URL Source: http://www.rfidjournal.com/article/articleview/2885/1/1/
Published: Dec 12, 2006
Author: Mary Catherine O'Connor
Post Date: 2006-12-13 00:33:19 by bluegrass
Ping List: *New History*
Keywords: None
Views: 250
Comments: 5
Dec. 12, 2006 — A revised version of a report from the Data Privacy and Integrity Advisory Committee, a subcommittee of the Privacy Office of the U.S. Department of Homeland Security (DHS), was cleared for publication at a Dec. 6 meeting of the committee in Miami Beach, Fla. The report, titled "The Use of RFID for Human Identification," will now be sent to DHS Secretary Michael Chertoff, as well as the DHS's chief privacy officer, Maureen Cooney. The reports also differ in describing the possible risks to personal privacy presented by the use of RFID technology in identity documents. The original version of the report says, "The use of RFID for human identification may create a number of risks that are not found in conventional and non-radio identification processes. Individuals will likely be subject to greater surveillance in RFID identification. They will be less aware of being identified and what information is transferred during identification, concerns that necessitate transparency in the design of RFID identification systems." In contrast, the revised report focuses on the personal-privacy risks created by any digital information system, over a manual system. "Digital identification systems pose privacy risks," the revised report states. "In a visual ID-check environment, a person may be briefly identified but then forgotten, rendering them anonymous for practical purposes. In a digital (RF-based) identity-check environment, by contrast, a person's entry into a particular area can be recorded and the information stored for some period of time. If not properly protected, this information could also be repeatedly shared or used for secondary purposes, even potentially used for broader surveillance."
The subcommittee wrote the 15-page report to guide Chertoff and Cooney in deciding whether to deploy RFID technology to identify or track individuals for such DHS programs as the PASS cards that will eventually be issued as an alternative to U.S. passports for travel in North America.
The original version of the report, written by the committee's Emerging Applications and Technology Subcommittee, was presented to the full Advisory Committee on June 7, 2006, at a public meeting in San Francisco (see DHS Meeting Draws Comments on RFID). At the time, it received a chilly reception by many representatives from companies selling RFID technology used in identification and credential applications, as well as from technology industry groups, because it came down hard on the use of RFID in identity documents. "We recommend that RFID be disfavored for identifying and tracking human beings," the draft report indicated, citing concerns over the skimming of personal data transmitted over a radio frequency signal, the cost of implementing RF technology and the existence of other authenticating technologies that could be used instead.
The final version of the report comes to a similar conclusion, according to coauthor Jim Harper, a director of information-policy studies for the Cato Institute, though its language has been softened. "I think a lot of the language was toned done, and a lot of assumptions that I feel strongly are true...were left out for the sake of congeniality," he says. One example he points to is the removal of most descriptions of RFID in identity documents as being "a tracking technology." Still, he says, there are no "recognizable substantive changes" to the latest version.
But in his reading of the latest report, Douglas Farry, a managing director and chair of the RFID practice at McKenna Long & Aldridge, a nationwide law firm focusing on the intersection of public policy and technology, sees a more pronounced change in the final draft. "It seems to be a better position than the initial draft, in that the initial draft concluded that the potential benefits [of using RFID in identity documents] were more than outweighed by the potential risks to personal privacy [that the technology presents]. But that's toned down. Now it says that if the DHS is going to use an RFID system, it should do so thoughtfully and carefully."
Both the original and revised reports are roughly the same length, and both share a common architecture and most of the same section and subsection content. However, the original version uses more pointed language. For instance, both versions state that RFID can provide a means of identifying a credential, but not the individual who is presenting it. To authenticate the bearer, they say, one or more biometric scans must be used to prove the credential was issued to the person presenting it. The two versions of the report diverge, however, in regard to the impact that authenticating the bearer would have on the process of RFID use to authenticate the document. "The steps needed to verify the biometric information using today's technology may reduce or negate the speed benefit offered by radio transmission," the revised report states. The original, however, contains the following wording: "Tying RFID to a biometric authentication negates the speed benefit [of using RFID]."
Harper says he hopes members of the DHS and representatives from the RFID and smart-card industry will take the report to heart, giving credence to the best practices and privacy-focused safeguards it recommends.
The DHS and the U.S. Department of State (DOS) are already beginning to embed RFID inlays in U.S. passports, so the final publication of the privacy report comes too late for use by those agencies in that regard. Still, Harper maintains, the report could still hold value to decision makers in other countries who are considering deploying electronic passports. The guidelines the United States and other nations are following for deploying RFID in passports, Harper says, were devised by the International Civil Aviation Organization (ICAO), do not require as many privacy safeguards as they should (see United States Sets Date for E-Passports).
The DHS and DOS also plan to RFID-enable the PASS card, a travel document that will be issued in lieu of a U.S. passport to identify U.S. citizens who travel to Mexico, Canada, the Caribbean or Bermuda (see New U.S. ID for Border Crossing to Use RFID). The agencies originally set a deadline of Dec. 18 for the public to submit comments on their plans to add RFID to the card (see DHS Proposes Vicinity RFID Technology for PASSport Card ). That deadline has now been extended to Jan. 8, and Harper says the Data Privacy and Integrity Advisory Committee hopes the agencies consider the report along with the public comments they are currently receiving, as they develop the PASS program.
Post Comment Private Reply Ignore Thread
Top • Page Up • Full Thread • Page Down • Bottom/Latest
#1. To: Zoroaster, BTP Holdings, Brian S, Jethro Tull, Tauzero, Red Jones, Lady X, noone222, Brian S, christine, Zipporah, robin, Peetie Wheatstraw, HOUNDDAWG, Uncle Bill, Dakmar, tom007, aristeides, Neil McIver, bluedogtxn, historian1944 (#0)
Note that the scare tactic isn't "The number of the Beast really sucks." The scare tactic is "we might be inconvenienced."
"Revisionism is an historical discipline made necessary by the fact that all States are governed by a ruling class that is a minority of the population, and which subsists as a parasitic and exploitative burden upon the rest of society." -Murray Rothbard
This has the same problem as any ID. If the card or tag itself carries the data, it's subject to counterfeiting. If a centralized database holds the data, it's subject to some functionary fat fingering a number during input and ruining someone's life, or subject to some damned fool taking the data home on a laptop and getting it stolen or compromised. RFID is really an interesting technology, and I think that eventually WalMart is going to be the driver for making it ubiquitous. For a loss prevention tool at a store, it cannot be beat. Make a membership card (like a Mobil speedpass) mandatory (note that I'm saying that a commercial enterprise could do this, under no circumstances should a government at any level be allowed to incorporate this, even though they won't ask permission) connected to a credit or debit card. Have interrogators at every avenue of ingress and egress. When you walk in, the store notes that you have entered. You fill your shopping cart, and walk out. Since every item is tagged, every item in your shopping card gets debited from your account. You can have less loss prevention types and fewer actual cashiers. There are still ways around this, but it is an interesting idea. For IDs, this is an abomination, though. It would make it too easy for the state to track citizens, and I still believe that the American people have a right to privacy, and a right to anonymity. Use of RFID in ID cards would remove both.
Which is why I'll refuse it. NO matter what the consequences.
In a time of universal deceit, telling the truth is a revolutionary act - - George Orwell Internal passports are then to be a side effect of North American Union / SPP.
You can never tire of counting conflict diamonds.
"Are your papers in order?!"
"The illegal we do immediately. The unconstitutional takes a little longer."Both the original and revised reports are roughly the same length, and both share a common architecture and most of the same section and subsection content. However, the original version uses more pointed language. For instance, both versions state that RFID can provide a means of identifying a credential, but not the individual who is presenting it. To authenticate the bearer, they say, one or more biometric scans must be used to prove the credential was issued to the person presenting it. The two versions of the report diverge, however, in regard to the impact that authenticating the bearer would have on the process of RFID use to authenticate the document. "The steps needed to verify the biometric information using today's technology may reduce or negate the speed benefit offered by radio transmission," the revised report states. The original, however, contains the following wording: "Tying RFID to a biometric authentication negates the speed benefit [of using RFID]."
#2. To: bluegrass (#1)
#3. To: historian1944 (#2)
For IDs, this is an abomination, though. It would make it too easy for the state to track citizens, and I still believe that the American people have a right to privacy, and a right to anonymity. Use of RFID in ID cards would remove both.
Law Enforcement Against Prohibition
In a CorporoFascist capitalist society, there is no money in peace, freedom, or a healthy population, and therefore, no incentive to achieve these - - IndieTX
#4. To: bluegrass (#0)
The subcommittee wrote the 15-page report to guide Chertoff and Cooney in deciding whether to deploy RFID technology to identify or track individuals for such DHS programs as the PASS cards that will eventually be issued as an alternative to U.S. passports for travel in North America.
#5. To: bluegrass (#1)
(Edited)
---Henry Kissinger, New York Times, October 28, 1973
Top • Page Up • Full Thread • Page Down • Bottom/Latest