Mar 25, 2008This article was originally published by RFID Update.
March 25, 2008—Today Washington Governor Chris Gregoire is expected to sign a bill making it a felony to skim personal data from RFID cards and documents. The state senate unanimously passed House Bill 1031 (HB 1031) last week. Its sponsor, House of Representatives Speaker Pro Tempore Jeff Morris, indicated to RFID Update that he has been told the governor will sign her approval today.
The bill applies to RFID and facial recognition technologies, and is narrowly focused on skimming. The key provision is Section 3, which reads:
A person that intentionally scans another person's identification device remotely, without that person's prior knowledge and prior consent, for the purpose of fraud, identity theft, or for any other illegal purpose, shall be guilty of a class C felony.
"We wanted to get some rules in place before the technology really comes into play," Rep. Morris told RFID Update.
Washington began issuing Enhanced Driver Licenses with RFID tags in January, and thousands of citizens have requested them. The Enhanced Driver License can be used instead of a passport for crossing the Washington border into Canada. Morris said it was important to establish RFID usage guidelines and protections since government and private RFID systems are growing throughout Washington.
"Legislators can be very good at being reactionary after there is some public outcry, then end up passing something that is really draconian," Morris said, suggesting that Washington HB 1031 is balanced and thoughtful legislation.
According to AIM North America executive director Dan Mullen, who was in contact with Washington lawmakers during the legislative process, the bill is a good example of legislation that emphasizes regulation of criminal activity, instead of regulation of the technology itself. "The fact that the bill focuses on behavior, and punishing behavior that is not appropriate, is something anyone can support," Mullen told RFID Update.
Mullen said the legislation seems reasonable and well written, but questions whether laws specifically legislating against RFID data interception are necessary in Washington or elsewhere.
"The computer crimes law in Washington state can be applied to RFID tags and the data they contain because the statutes do not allow a person to access any data without permission or other operation of law," Mullen said. "For example, laws prohibiting stalking and identity theft, as well as illegal access to computer systems, are already on the books in Washington state. We feel it would be much more appropriate to update current statutes that cover the behaviors that they are trying to address in HB 1031."
Lawmakers in Washington may have felt a need to address RFID specifically because of the state's central role in emerging RFID citizen identification programs. Washington is one of four border states -- along with Arizona, New York, and Vermont -- that have signed cooperative agreements with the Department of Homeland Security to use the same RFID technology in their enhanced drivers licenses as the national PASS Card (see Digimarc Selected to Produce RFID Driver's Licenses), which the federal government is making available to US citizens who frequently cross borders into Canada and Mexico.
The PASS Card program remains controversial, with many opponents claiming the State Department, which manages the program, issued Gen2-based RFID technology specifications that create unnecessary security holes. The State Department's position is that PASS Cards are secure because they contain only a unique ID number and not any personal information that could be skimmed (see US Gov Sets Controversial RFID Passport Card Specs).
Washington is also home to a people-tracking trial at the University of Washington's Seattle campus (see University Launches RFID People Tracking Experiment). The RFID Ecosystem Project that faculty and students are conducting there will not be affected by the new law because the opt-in program is voluntary and participants give their permission to be identified with RFID.
Update: As predicted, the Washington state anti-skimming law was indeed signed into law on Tuesday, March 25th.
