Smart Card Alliance Urges U.S. Government to Reconsider Passport RFID

"Our members, who include technology providers of both contactless smart card and RFID products, understand human identification security and agree that the vicinity read RFID technology proposed for the passport card is the wrong technology to implement a secure identification card," said Randy Vanderhoof, executive director of the Smart Card Alliance.

"We urge the State Department and Department of Homeland Security to reconsider this decision in favor of more secure 'proximity' contactless smart card technology for the passport card. Long range RFID tag technology is used typically to track products, while contactless smart card technology is already in place at the border to validate the identities of travelers with ePassports. Contactless smart card technology has also been recommended by NIST for more than 10 million government employee and contractor identification cards that began to be issued last month."

In its response to the State Department's notice, the Alliance provides details of its concerns with the passport card decision to use vicinity read RFID technology, and gives recommendations for measures that the Department of Homeland Security (DHS) and Department of State could implement to improve the passport card program. The issues with the proposal detailed in the response include:

• Lack of security safeguards in long range RFID technology
• Potential for tracking and citizen distrust
• Duplication of required border infrastructure to accept this identity document technology in addition to ePassports
• Reliance on central databases and real-time access to networks
• Questionable throughput expectations for proposed operational scenario
• Potential operational issues with multiple vicinity read RFID tags in vehicles
• No standards review or open discussion of implementation approach

"The U.S. government needs to focus on a policy for efficient border crossing that increases border security and citizen privacy," said Neville Pattinson, director of technology and government affairs, Gemalto and the co-chair of the Smart Card Alliance Identity Council. "The necessary technology is readily available to back up such a policy. Contactless smart card technology, compatible to that already being used globally in electronic passports, possesses all the security features necessary to protect citizen privacy, whilst upholding all operational parameters at the land border check points."

The Alliance states many advantages to using contactless smart card technology for the passport card program, including the ability to support electronic verification of authenticity to prevent counterfeiting and to use secure, encrypted communications to thwart eavesdropping and replay attacks, and ensure privacy protection for cardholders. A passport card based on contactless smart card technology can also leverage the infrastructure that is being put in place by DHS and the Department of State to support the new ePassport.

"We support the conclusions of the Smart Card Alliance," said Tres Wiley, director of eDocuments for Texas Instruments, a provider of both vicinity and proximity technologies. "The vicinity technology being proposed by the U.S. government was not intended or designed for sensitive ID applications such as the Western Hemisphere Travel Initiative passport card; secure proximity technology, like that in the new ePassport, was designed expressly for that purpose."

The Smart Card Alliance submitted its response to the Federal Register notice on November 3, 2006. The full response can be viewed at: http://www.smartcardalliance.org/resources/pdf/Smart_Card_Alliance_Response_Passport_Card_Final.pdf