State, ACLU spar over security of new passports

The government's new digital passports will not be insecure or pose a risk to privacy'as the American Civil Liberties Union claims'the State Department says.

The department is on schedule to begin delivering passports with embedded biometric chips next year.

ACLU has said the passports could broadcast personal information to passersby using radio frequency identification readers. But Frank E. Moss, deputy assistant secretary of State for passport services, downplayed such concerns and said the department would resolve any technical problems before the passports begin circulation.

Laura Murphy, director of ACLU's Washington Legislative Office, warned that identity thieves could capture data from the digital passports.

Moss said the ACLU concern arises from two separate technical issues:
  • Skimming: A passerby nabs the biometrics on a passport by using an RFID reader.

  • Eavesdropping: An unauthorized person captures the information when a passport reader at a border station reads a passport chip.

  • He said skimming is much more technically challenging than ACLU describes. 'It is not like an E-ZPass system on the New Jersey Turnpike,' he said.

    The department and its contractors are aggressively investigating means of preventing skimming. 'We will not release any passports with embedded biometrics until the skimming problem is solved,' Moss said. There are types of metal shielding to prevent skimming, he added.

    As to eavesdropping, Moss said passport reader technology can prevent that. 'Some rudimentary readers were susceptible to eavesdropping,' he said. But current technology limits the maximum passport reading distance to 10 centimeters.

    ACLU has called for State to encrypt the data on the passports, but 'we do not believe it is necessary or appropriate,' Moss said. He added that encryption would run counter to the goal of achieving globally interoperable passport technology.

Stay Connected

Sign up for our newsletter.

I agree to this site's Privacy Policy.