State Department Admits RFID Passports Are Insecure

The State Department is advising travelers using super-secure RFID-enabled passports to buy a “radio-opaque” holster, because it turns out that RFID chips aren’t so super-secure after all. Don’t fret if “radio-opaque sheath” isn’t on your holiday shopping list, this is thankfully one of those rare problems that you can solve with a hammer…

Give the back of your passport a few good whacks and hope the feds don’t give you 25 years for tampering with a passport.

The State Department asserts that hackers won’t find any practical use for data skimmed from RFID chips embedded in the cards, but “if you don’t want the cards read, put them in an attenuation sleeve,” says John Brennan, a senior policy adviser at the Office of Consular Affairs.

Gigi Zenk, a spokeswoman for the Washington state Department of Licensing, says the envelope her state offers with the enhanced driver’s license “ensures that nothing can scan it at all.”

But that wasn’t what researchers from the University of Washington and RSA Laboratories, a data security company in Bedford, Mass., found last year while testing the data security of the cards.

The PASS card “is readable under certain circumstances in a crumpled sleeve,” though not in a well maintained sleeve, the researchers wrote in a report.

Another test on the enhanced driver’s license demonstrated that even when the sleeve was in pristine condition, a clandestine reader could skim data from the license at a distance of a half yard.

Well well, State Department, here’s a sad little communiqué you never expected from the internet: we told you so.

Special alloy sleeves urged to block hackers? [AP via Upgrade: Travel Better]
PREVIOUSLY: HOW TO: Disable RFID in Your New Passport
(Photo: Ryan McFarland)

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.