Feeds

Biz travelers howl over US gov RFIDs

Border (in)security

Choosing a cloud hosting partner with confidence

A travel industry group has called on the US government to halt its use of new machinery that remotely reads government issued identification cards at border crossings until the safety of the new system can be better understood.

Monday's call by the Association of Corporate Travel Executives (ACTE) follows similar requests by a chorus of civil liberties and computer researchers. They warn that use of the new long-range radio frequency identification (RFID) scanners could jeopardize the privacy and security of people who pass through US borders.

"ACTE is concerned that unauthorized individuals could either resort to electronic eavesdropping at the border or use similar devices that could extract data from RFID chips at other locations," the group's executive director said in a statement. She asked for the system to be halted pending a comprehensive security review.

In July, researchers with RSA Laboratories and the University of Washington published a paper exposing several risks posed by RFID system used in US passport cards and drivers licenses issued by several states that emit RFID signals. They found the documents were susceptible to cloning, a vulnerability that could allow attackers to assume the identity (at least partially) of others.

The researchers also said it was possible for unauthorized parties to remotely read the RFID information embedded in the documents. Interestingly, drivers licenses issued by Washington state were vulnerable to remote scanning even when placed in protective sleeves, the report found.

The information contained in the documents is at the moment limited to an index number that functions similar to a social security number. But civil liberties groups say it still might be enough to allow the tracking of travelers' whereabouts.

"We think there's a significant risk down the road of people being tracked by these static unique ID numbers," Lee Tien, a senior staff attorney for the Electronic Frontier Foundation, told The Register. "How hard is it to harvest numbers and associate them with people's names?"

According to a recent article in USA Today, the scanning machines are in place at five locations as part of the government's requirement that anyone who crosses the border show government-issued ID. The ID can be read from a distance of 50 feet.

In addition to Washington, New York State is also issuing drivers licenses that embed RFID information that works with the system. ®

Internet Security Threat Report 2014

More from The Register

next story
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Edward who? GCHQ boss dodges Snowden topic during last speech
UK spies would rather 'walk' than do 'mass surveillance'
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
China is ALREADY spying on Apple iCloud users, claims watchdog
Attack harvests users' info at iPhone 6 launch
Carders punch holes through Staples
Investigation launched into East Coast stores
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.