Will the New National ID Track Your Movements?by James Plummer
James Plummer is the policy director for the Liberty Coalition. By the end of September virtually unaccountable bureaucrats inside the Department of Homeland Security will likely have decided whether the new de facto national ID card will broadcast your sensitive identification information wherever you goMinority Report style.
This comes as a result of the REAL ID Act. REAL ID was signed into law in May. As a result of negotiations over the intelligence-reform bill passed last December, the law had been attached to the first must-pass bill of 2005, which turned out to be emergency spending for the Iraq war. Thus a vote against this national ID would have been spun as a vote against the troops as well.
REAL ID gave the Department of Homeland Security (DHS) the sole right to issue design requirements for drivers licenses, needing only to consult (that is, ignore) state officials and the Department of Transportation. Though the official publication of the design requirements is still some months off, DHS is expected to make an internal decision on one of those requirements, regarding machine-readable technology standards, by early fall. And there is a lot of pressure on DHS from the surveillance-technology industry to make radio-frequency identification (RFID) microchips the required machine-readable technology.
The REAL ID Act repealed a provision in the intelligence-reform bill to assemble a committee of state officials, privacy watchdogs, and federal officials to set standards for state drivers licenses. As a result, those moderating voices of federalism, privacy, and common sense have now been silenced. One of those voices, the National Conference of State Legislatures, has conservatively estimated compliance costs at up to $750 million initially and $75 million annually thereafterjust another expense to be passed on to the taxpayer for the privilege of driving or flying with a national ID card.
States that dont go along with the new standards will find that their citizens cannot use their state drivers licenses for federal identification. That means the Transportation Security Administration wont let Americans with noncompliant drivers licenses board airplanes, unless perhaps they have a passportwhich themselves are scheduled to have RFID soon.
RFID technology in an identification card consists of an embedded microchip and antenna that broadcasts identity information, decodable by specially designed readers. On an identifying document such as a drivers license, RFID is an unnecessary, dangerous technology in todays information-rich world. RFID-enabled identity cards can broadcast identifying information to persons and institutions without the knowledge or consent of the license holder. That information, such as a name, birth date, identification number, or even digital photo, could then be cross-referenced through commercial and government databases to gain increasingly sensitive identity information on the individual.
That kind of technology on essentially mandatory government documents can lead to identity fraud, endangering the victims finances, privacy, and even physical safety.
RFID technology could also enable tracking of individuals, as the chip broadcasts the cardholders presence to each reader he passes. No matter how secure the RFID protocols allegedly are, broadcasting ones presence to a series of readers leaves a record of ones place and time. That information can be taken by hidden readers just about anywhere an American goesa political meeting, a gun show, a place of worship. It is an open invitation to stalkers and thieves, as well as government agents who regard constitutional proscriptions on search and surveillance as obstacles rather than as American principles.
Advocates of the technology often claim RFID can be set to only broadcast a limited distance, such as a few centimeters. But as security expert Bruce Schneier has pointed out, This is a spectacularly naïve claim. All wireless protocols can work at much longer ranges than specified. In tests, RFID chips have been read by receivers 20 meters away. Improvements in technology are inevitable.
There is no significant security benefit in mandating that drivers licenses and/or identification cards carry an RFID chip. There are, however, significant risks to security and privacy. If an RFID reader must purportedly be within a few centimeters of the identification card, there is no logical reason not to close the security loop and require the card make contact with the reader.
Tri-National ID
Some quick background: The original version of the REAL ID Act would have had every state join into something called the Driver License Agreement, which would have included states of Mexico and provinces of Canada as well, creating a de facto tri-national ID card. Although that provision was removed from the final legislation after protests by privacy advocates, there is a danger that RFID standards in particular could easily be integrated into international identification schemes. The United Nations International Civilian Aviation Organization (ICAO) is pushing for standardized RFID on the passports of every nation. The U.S. State Department has already announced plans to include RFID in passports in the near future, with standards based on ICAO recommendations. And meanwhile, the British governments plans for a national ID card include ICAO RFID standards.
Could DHS be seriously considering turning state drivers licenses into national ID cards, essentially internal passports based on UN standards? It seems they may indeed be headed that way.
As Americans learn more about RFID technology, they are rightly concerned about these dangers. The California Assembly is considering a bill to ban RFID from state identification documents for at least three years as security questions are studied. The Montana House of Representatives has already passed a bill opting out of any nationalized ID standards. Montana legislators were concerned that such a system would endanger the privacy of that states citizens. If DHS adopts mandatory RFID for drivers licenses, those concerns would be proven valid.
If the Department of Homeland Security takes personal security and privacy, not to mention constitutional values, at all seriously, it will reject RFID or any kind of contactless reading technology as appropriate for drivers licenses the new de facto national identification cards.
http://www.fee.org/vnews.php?nid=7149.
