Five Reasons why RFID won't stop terrorism

10-08-2004

This morning on Slashdot there was an article posted that talks about how the state of Virgina is considering putting a RFID tag on all drivers licenses. Part of the reasoning is that they where embarrassed because nine of the 9-11 terrorist hijackers legally obtained drivers licenses there.

Firstly, I believe all of the hijackers where inside of the US legally. There's no reason for Virginia to be embarrassed, they processed them into the system without bypassing any laws. This isn't their fault.

Second, the business of requiring a drivers license in order to be a passenger on a plane is not 100% without merit, but already worthless. All of the hijackers had proper identification so this measure is already useless. How can being able to identify them from 20 feet rather than 2 feet help prevent this problem in the future? Ah, I bet a national database would help that out some. Or would it? Lets say a potential hijacker gets a valid license in Virginia again. Oh wait, now his falsified data is in the national database too. He's legal to fly now.

Third, biometric data is being pushed as data that can be stored on the RFID tag. Anyone with even an ounce of knowledge about the current state of biometrics knows this technology is still in it's infancy. I would be EXTREMELY worried if this was considered enough to properly identify someone. It's not exaggeration to say that silly putty and Jello are all that is required to bypass most fingerprint scanners, and other biometrics are easily defeatable as well.

Fourth, one of the claims is that RFID "...may prevent identity fraud...". I don't see how. How many purchases do you make on a daily basis that require a drivers license? Perhaps some banking transactions would be prevented. My bank will let me transfer money if I don't have my license, they just ask for my social security number. I'm not faulting them, just saying that an RFID enabled license or national database won't stop this type of activity.

Fifth, anyone that's ever heard of wardriving should instantly realize the potential for abuse by this RFID drivers license system. I can't imagine it being too hard to acquire an RFID reader device, they have to be sold somewhere. Just sitting on a bench at the mall could allow a person to collect hundreds of identities. You have the option of having your social security number stamped on your drivers license, how many of you do this? More than likely this data will be in the RFID tag as well. Name, DOB, address, SS#, and a full description of what you look like. And oh yes, all your biometric signature('s). The reverse of the silly putty trick could then be used. Not only did they use your identity, they left your own finger prints at the scene of the crime.

"Couldn't they encrypt the RFID data? Wouldn't that fix that problem?" Sure, I bet there's a good way to implement an encryption system to prevent mass acquisition of peoples identities at the mall. Just remember, the companies implementing this will be the lowest bidder for the state. And also remember, these are the same companies that claim RFID and biometrics are safe and accurate to begin with. Still think they can get this right?

Now, I am not trying to pick on the state of Virginia here. They perceive a problem and are trying to take measures to prevent the problem which is commendable. However in the rush to stamp out terrorism legislators need to be fully aware of the consequences of their actions. They are not experts in biometrics and technology. Most of them probably only know what the big PR wheel in the sky tells them about biometrics and RFID. Any mission statement from a biometrics or RFID manufacturer will claim something about improving privacy and making people feel more secure. Who doesn't want to feel more secure and have more privacy? The unfortunate truth is quite different however. We need to raise awareness of the faults and pitfalls in these emerging technologies. Don't sit by and remain idle while your elected officials legislate your rights away purely out of ignorance.

dosman