www.aclu.orgJOIN THE ACLUTAKE ACTIONDONATEABOUT US
ACLU Blog of Rights - Official Blog of the ACLU National Office Blog of Rights Homepage Support the ACLU

Categories

Join Us At:
« The Secret Weapon in the No on Prop. 8 Fight
Bad Idea: Spying on Peaceful Activists and Labeling Them as Terrorists »
Oct 24th, 2008 Google Bookmarks Technorati StumbleUpon Digg! Reddit Delicious Facebook
Posted by Christina Drummond, ACLU of Washington at 6:34pm
Technology and Liberty

Privacy and Security Concerns for Washington's Enhanced Driver's License

Researchers from the University of Washington and RSA Labs just published a paper on the privacy and security vulnerabilities of the RFID tags embedded within Washington's Enhanced Driver's License (EDL) and the U.S. Passport Card. In addition to confirming that the EPC Gen2 RFID tags in these documents can be remotely copied (i.e., cloned), this paper uncovered a number of concerns:

  • The unique identification number on the RFID tags can be read from great distances, allowing the EDL or Passport Card holder to be tracked from up to 50 meters away (162 ft.), or the width of a football field!
  • Even if EDL cardholders have their card within a protective foil sleeve provided by the Department of Licensing, the unique identification number on the RFID still can be read from up to two feet away.
  • Anyone with access to an EPC Gen-2 RFID reader can permanently disable the RFID tag within an Enhanced Driver's License, without the cardholder ever knowing. This creates a serious problem for cardholders, since our administrative code states that, "...tampering with or deactivating the chip will invalidate the enhanced driver's license or identicard for purposes of border crossing." (WAC 308-105-020(4))
The ACLU of Washington has been watching the EDL's development closely, submitting comments on the administrative rule and highlighting privacy concerns at an RFID policy roundtable. With the support of the Department of Licensing we worked to pass HB 2729, the first state law to deter RFID tracking by making it illegal to read the RFID tag on an EDL when not at a border crossing.

This research shows that government agencies need to implement strong privacy safeguards when developing border crossing documents.

And cardholders need to consider their options carefully when choosing what type of border crossing ID to get. Not sure what to do since even U.S. Passports have RFID? Educate yourself with our flyer (pdf) on the differences between these documents.

Those who'd like to see the research in action can check out this KOMO4 News story. It's worth noting that the $2,000 readers used are pretty standard for any business using the EPC Gen2 tags to replace bar codes for inventory tracking.

Google Bookmarks Technorati StumbleUpon Digg! Reddit Delicious Facebook
Permalink | 
Technology and Liberty
We intend the comments portion of this blog to be a forum where you can freely express your views on blog postings and on comments made by other people. Given that, please understand that you are responsible for the material you post on the comments portion of this blog. The only postings that we ask that you refrain from posting and that we cannot permit on our website are requests for legal assistance and postings that could cause ACLU to incur legal liability.

One important law in that regard is the prohibition on politically partisan activity. Given our nonprofit status, we may not endorse or oppose candidates for elective office. That means we cannot host comments on our site that show a preference for one candidate or party. Although we in no way wish to discourage you from that activity elsewhere, we ask that you not engage in that activity on our website (or include links to other websites that do so). Additionally, given that we are subject to very specific rules concerning the collection of personally identifying information through our website (names, email addresses, home address, financial information, etc.), we ask that you not use the comments portion of this blog to solicit this information from users of our website. We also ask that you not use the comments portion for advertising or requests for legal assistance, and do not add to your comment links to other websites, as we cannot be responsible for the content on other websites.

We are not able to respond to unsolicited inquiries, complaints or requests for assistance sent to this blog. Please direct your complaint or request for assistance to the ACLU affiliate in your state. Requests for legal assistance left in the blog comments will not receive a response or be published.

Finally, the ACLU cannot guarantee the accuracy, completeness or usefulness of any information in the comment section and expressly disclaims any liability for any information in this section.

1 Response to "Privacy and Security Concerns for Washington's Enhanced Driver's License"

  1. Ryan Says:
    Oct 25th, 2008 at 8:57am

    I'm starting a pool as to when our rights are completely disappeared. Early 2011 is my guess.

    ryanhartman.wordpress.com

The content of this field is kept private and will not be shown publicly.
  • Allowed HTML tags: <a> <em> <strong> <cite> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • Lines and paragraphs break automatically.

More information about formatting options

CAPTCHA
This question is for testing whether you are a human visitor and to prevent automated spam submissions.
Image CAPTCHA
Enter the characters shown in the image. Ignore spaces and be careful about upper and lower case.
 

Quicksearch

Recent Entries

ACLU Affiliate Blogs


© ACLU, 125 Broad Street, 18th Floor New York, NY 10004
This is the Web site of the American Civil Liberties Union and the ACLU Foundation.
Learn more about the distinction between these two components of the ACLU.

User Agreement | Privacy Statement | FAQs | Site Map

Statistics image