Features

net.wars: Pass the e-port

European callers to airlines have for some time now been read a message that beginning in October 2004 they will require a machine-readable passport to visit the US. What they may not realise as they stand on line to be fingerprinted and iris-scanned under the US-Visit program is that the US is not being much less invasive to its own citizens.

The next move is the RFID-enabled passport, which this week has provided the classic  Computers, Freedom, and Privacy blood-on-the-carpet moments and which garnered for itself a couple of Big Brother Award nominations .

The personae: Frank Moss, deputy assistant secretary for passport services at the Department of State, and, among others, Ed Hasbrouck , who probably knows more about travel industry data practices than anyone. With quivering intensity Hasbrouck endeavoured to explain to Moss exactly why the RFID plan was so dangerous and how it could percolate throughout air travel; Moss was impervious. Hasbrouck was not atypical.

The big question, as many CFPers tried to indicate to Moss, was why contactless RFID chips rather than chips like those in today's smart cards that have to be physically in contact with the reader to divulge their data. Standards. That's why.

Moss explained that the International Civil Aviation Organization, which sets passport standards, wanted to introduce the technology in a way that involved as few changes as possible to the production systems. If he explained you used a chip that required contact, that chip would have to be located in one standard position so that readers from various countries would interoperate. A contactless chip that could be read at distances of up to 10cm - four inches for the metrically challenged - would allow travellers' documents to be read before they reached the inspector, so their data is displayed on the screen by the time they reach the desk. Nice idea: imagine passengers speeding through immigration the way cars whiz through tollbooths using the EZ-Pass transponder payment system. The chip can be anywhere in the passport for such a system and readers can vary too.

The thing is, there are so many risks to doing this. RFID is largely an untested technology especially on this scale; we don't have any systems in place on this scale (although, granted, they are rolling out in other applications, such as retail). Hasbrouck and others raised the issue of cloning, where someone might skim the data as it's being read and use the captured information to create a copy of that passport. Moss says the skimming risk can be mitigated by using the right materials in the cover.

British folks, who've been listening to Blair and Blunkett defend the ID card proposal for months on the basis that the ICAO and the US will require us to have biometrics in our passports anyway, so the costs of the ID card itself are smaller than we think, will be intrigued to hear that this is not true.

Moss said categorically that the US is not pressuring the UK to include biometrics beyond the ICAO-mandated digital photograph. The fingerprints and iris scans are all Blair's and Blunkett's. The basis of everything is still the face. The other bit of good news in all this is that if you dislike the chips the passport remains a valid travel document even if you cook it dead. That may not be true, of course, if similar technology extends throughout identification documents of all types.

But although the State Department got an unprecedented 2,400 comments in response to this project, it's going ahead whether we like it or not. At this point, if you want it to change Americans will have to lobby their Senator and/or Congressman and hope he pays attention.

He may not. Because the thing is, at the moment this is truly a minority issue.

It may become less so if airlines start asking for passports from domestic travellers. As my European friends like to remind me as evidence of how unsophisticated and provincial Americans are, only 23 percent of the population have passports.

The 23 percent doesn't, by the way, represent the actual percentage of native-born US citizens who have passports. According to Moss, there are 62 million US passports currently in circulation, representing ten years of successful applications. Of those, five to ten million were issued to newly naturalised immigrants, who almost always want to apply for a passport as soon as they get citizenship so they can go back home and visit family.

Another chunk of those passports were issued to the US-born children of illegal immigrants, since their parents have a strong interest in proving those kids' right to be here and go to school. So the proportion of native-born US citizens who apply for passports is a lot smaller than it first appears, perhaps around 10 percent. Americans, without leaving the US, can experience as great or greater geographical diversity as the passport-bearing European; what they miss is a certain amount of cultural diversity.

So, basically, if you're an American and your passport, like mine, will expire shortly, now is your chance to be one of the last to get a non-chipped passport. That will buy you time while they find out whether the privacy advocates' warnings are correct and how to deal with the security risks. Ten years ought to be long enough to get the bugs out.