At what point do you start worrying about the RFID tag in your passport?


Does your passport look like this, with a strange-looking symbol on the bottom? Then you’re in luck, for your passport contains an RFID tag! Now, we’re not exactly the tin foil hat types, but news that one of those security researcher types has managed to copy sensitive data off various passports in San Francisco without the owners’ knowledge does annoy us. What’s worse is that the pertinent officials, the Foggy Bottom bunch, don’t really seem to care. Why would they?

It’s like this: Chris Paget, a security researcher, built a $250 device with off-the-shelf (read: eBay) components. With this device in hand, he sped around the mean streets of San Francisco, looking for passports to scan, and he found some! The RFID tags don’t contain any identifying information per se—it’s not like the tag says, “This is John Smith’s passport, and his Social Security Number is 123-45-6789”—but then do contain a unique number.

The real problem starts if an Evildoer is able to sync up a passport number with a driver’s license number. (Some new driver’s licenses contain RFID tags.) Now the Evildoer has both your non-identifying passport and the info from your driver’s license, which, presumably, does contain identifying info. Now the Evildoer has your personal info! Horror!

The State Department, which issues passports, had nothing to say about the matter. Customs, however, offered The Register a weak quote, saying that doomsayers will always look for a way to demonize a new technology. Apparently saving a few minutes scanning people at airports and other border crossings is worth more than personal, and national, security. Maybe if these security researchers threw around scary-sounding words like “terrorism” or “Islam is the light” then the government will pay more attention. Or maybe we’ll have to wait for Today Show producers to catch wind of this and put together a segment, scaring Middle America and generating the attention this warrants. After all, it’s one thing for a security researcher to make a YouTube video, which is then picked up techies like The Register (and us here at CG), but it’s an entirely different can of beans when you scare Middle America into action. Someone call Hannity!

Photo: Flickr