Washington RFID Bill Expected to Become Law Today
A new law in the State of Washington makes it a felony to skim personal information encoded in RFID tags. The law applies to Washington's new RFID-enabled Enhanced Driver Licenses, federal PASS Cards used in the state, and also to access control cards, loyalty cards, and any other RFID card or document that holds personal information.
Mar 25, 2008—This article was originally published by RFID Update.
March 25, 2008—Today Washington Governor Chris Gregoire is expected to sign a bill making it a felony to skim personal data from RFID cards and documents. The state senate unanimously passed House Bill 1031 (HB 1031) last week. Its sponsor, House of Representatives Speaker Pro Tempore Jeff Morris, indicated to RFID Update that he has been told the governor will sign her approval today.
The bill applies to RFID and facial recognition technologies, and is narrowly focused on skimming. The key provision is Section 3, which reads:
A person that intentionally scans another person's identification device remotely, without that person's prior knowledge and prior consent, for the purpose of fraud, identity theft, or for any other illegal purpose, shall be guilty of a class C felony.
"We wanted to get some rules in place before the technology really comes into play," Rep. Morris told RFID Update.
Washington began issuing Enhanced Driver Licenses with RFID tags in January, and thousands of citizens have requested them. The Enhanced Driver License can be used instead of a passport for crossing the Washington border into Canada. Morris said it was important to establish RFID usage guidelines and protections since government and private RFID systems are growing throughout Washington.
"Legislators can be very good at being reactionary after there is some public outcry, then end up passing something that is really draconian," Morris said, suggesting that Washington HB 1031 is balanced and thoughtful legislation.
According to AIM North America executive director Dan Mullen, who was in contact with Washington lawmakers during the legislative process, the bill is a good example of legislation that emphasizes regulation of criminal activity, instead of regulation of the technology itself. "The fact that the bill focuses on behavior, and punishing behavior that is not appropriate, is something anyone can support," Mullen told RFID Update.
Mullen said the legislation seems reasonable and well written, but questions whether laws specifically legislating against RFID data interception are necessary in Washington or elsewhere.
"The computer crimes law in Washington state can be applied to RFID tags and the data they contain because the statutes do not allow a person to access any data without permission or other operation of law," Mullen said. "For example, laws prohibiting stalking and identity theft, as well as illegal access to computer systems, are already on the books in Washington state. We feel it would be much more appropriate to update current statutes that cover the behaviors that they are trying to address in HB 1031."
Lawmakers in Washington may have felt a need to address RFID specifically because of the state's central role in emerging RFID citizen identification programs. Washington is one of four border states -- along with Arizona, New York, and Vermont -- that have signed cooperative agreements with the Department of Homeland Security to use the same RFID technology in their enhanced drivers licenses as the national PASS Card (see Digimarc Selected to Produce RFID Driver's Licenses), which the federal government is making available to US citizens who frequently cross borders into Canada and Mexico.
The PASS Card program remains controversial, with many opponents claiming the State Department, which manages the program, issued Gen2-based RFID technology specifications that create unnecessary security holes. The State Department's position is that PASS Cards are secure because they contain only a unique ID number and not any personal information that could be skimmed (see US Gov Sets Controversial RFID Passport Card Specs).
Washington is also home to a people-tracking trial at the University of Washington's Seattle campus (see University Launches RFID People Tracking Experiment). The RFID Ecosystem Project that faculty and students are conducting there will not be affected by the new law because the opt-in program is voluntary and participants give their permission to be identified with RFID.
Update: As predicted, the Washington state anti-skimming law was indeed signed into law on Tuesday, March 25th.
Login and post your comment!
Not a member?
Signup for an account now to access all of the features of RFIDJournal.com!
SEND IT YOUR WAY
RFID JOURNAL EVENTS
ASK THE EXPERTS
Simply enter a question for our experts.