"Our members, who include technology providers of both contactless smart card and RFID products, understand human identification security and agree that the vicinity read RFID technology proposed for the passport card is the wrong technology to implement a secure identification card," said Randy Vanderhoof, executive director of the Smart Card Alliance.
"We urge the State Department and Department of Homeland Security to reconsider this decision in favor of more secure 'proximity' contactless smart card technology for the passport card," continued Vanderhoof. "Long range RFID tag technology is used typically to track products, while contactless smart card technology is already in place at the border to validate the identities of travelers with ePassports. Contactless smart card technology has also been recommended by NIST for more than 10 million government employee and contractor identification cards that began to be issued last month."
In its response to the State Department's notice, the Alliance provides details of its concerns with the passport card decision to use vicinity read RFID technology, and gives recommendations for measures that the Department of Homeland Security (DHS) and Department of State could implement to improve the passport card program. The issues with the proposal detailed in the response include:
- Lack of security safeguards in long range RFID technology
- Potential for tracking and citizen distrust
- Duplication of required border infrastructure to accept this identity document technology in addition to ePassports
- Reliance on central databases and real-time access to networks
- Questionable throughput expectations for proposed operational scenario
- Potential operational issues with multiple vicinity read RFID tags in vehicles
- No standards review or open discussion of implementation approach
The Alliance states many advantages to using contactless smart card technology for the passport card program, including the ability to support electronic verification of authenticity to prevent counterfeiting and to use secure, encrypted communications to thwart eavesdropping and replay attacks, and ensure privacy protection for cardholders. A passport card based on contactless smart card technology can also leverage the infrastructure that is being put in place by DHS and the Department of State to support the new ePassport.