DHS Meeting Draws Comments on RFID

A representative of the Smart Card Alliance, a not-for-profit association made of members of the contact-based smart card and RFID (or contactless) smart card industries, told the committee that US-Visit's use of UHF RFID is "not a secure approach." He added that only certain types of HF tags and readers—which the Smart Card Alliance calls contactless smart card technology, rather than RFID technology—are appropriate for identity documents, because they offer proven and standards-based data protection protocols. UHF technology, he says, is "subject to attacks."

Dan Mullen, president of AIM Global, said the subcommittee's report was based on "misunderstandings" about what RFID technology is and what it can or should be used for. He said these misunderstandings are "generated by addressing RFID as a monolithic technology" rather than as a range of technologies with differing read ranges and security safeguards.

Industry representatives suggested that rather than basing its recommendations around specific technology, the committee should instead establish privacy and security policies independent of technology. Then, once that framework is set, they recommended applying standards-based technology compliant with that policy.

During the afternoon, panels discussed the expectations of privacy in public places and identity authentication. Panel members delved into a high-level analysis of how citizens share information, and how that shared data may (or may not) be protected by the Fourth Amendment to the U.S. Constitution. During the panels, MIT professor Daniel Greenwood invited committee members to consider MIT's briefings and white papers about RFID and identity management, available at the MIT ECAP Web site.

The DHS's Clooney said the meeting presented a "great opportunity for people with divergent views to share them with the committee." She added that in developing its recommendations, the committee is starting from "a neutral position with respect to all technology" and appreciates the comments and education offered by members of the RFID industry.

Howard Beales, chair of the Data Privacy and Integrity Advisory Committee, said the subcommittee would now consider the comments and begin revising the draft document. Revisions will likely be discussed at the committee's next meeting in September, he added. Once the committee finalizes the report, it will be submitted, as an advisory, to Secretary Chertoff.