DHS Subcommittee Advises Against RFID

The DHS report surveys the various methods by which a human subject's identity can be presented and authenticated by a DHS agency at airports, government buildings, border checkpoints and other locations, and claims that RFID can not improve the speed at which a human subject can be identified. The technology can lead to fast data transfer between the piece of identification and a reader, but without being linked to a biometric proving the identity of the ID-holder, it says, a person can not be reliably identified.

Still, linking the RFID tag to a biometric (such as a photograph or fingerprint of the person being identified) decreases the benefit of speedy data transfer. "In terms of speed, the use of RFID probably represents only a marginal improvement in speed over alternatives such as contact chips, 2-D bar codes and optical character recognition," the report says.

According to the report, the "benefit provided by the use of RFID in identification documents is not a product of its use of radio, but rather the fact that the data is in a digital format. Any data in digital format can be encrypted. Thus, RFID as such offers no anti-forgery or anti-tampering benefit over alternatives such as contact chips, bar codes or pixelization."

Morever, the report goes on to claim, the use of RF signals to transmit data presents some risks not found in contact-based chips and other technologies. These risks include the interception of data linked to one's identity through skimming (creating an unauthorized connection with an RFID tag to pull data from it) or eavesdropping (intercepting data being exchanged between an RFID tag and an authorized reader). The report, however, does not mention any recorded instances of such privacy invasion occurring.

Finally, the draft report concludes that the use of RFID in identity devices will make people carrying the devices "subject to greater surveillance" than those not carrying RFID-enabled IDs. Individuals, it states, will not know when, outside of presenting an ID to an agent for visual inspection, the devices they hold might be read surreptitiously within a public area.

Based on these security risks, as well as the benefits of using RFID compared with other means of transferring data from a ID to a back-end data system, the report concludes that the DHS "should consider carefully whether to use RFID to identify and track individuals, given the variety of technologies that may serve the same goals with less risk to privacy and related interests."