[continued from previous message] 
  
 "What concerns me is that this demonstrates bad design on the part of the 
 Home Office, and we know that government IT projects have a habit of going 
 terribly wrong. There is a lack of security in what we can see - so what 
 about the 90% of the iceberg in the system that we can't see? 
  
 "There isn't even a defence against the brute-force attack. In much the same 
 way as you are only allowed three attempts to feed in your PIN number at an 
 ATM, the passport chip could have been made to stop allowing repeated 
 incorrect attempts to contact it. As things stand, a computer can keep 
 trying until it gets the numbers right. To say this doesn't matter displays 
 a cavalier lack of concern." 
  
 The problems we have identified with RFID chips in passports raise all sorts 
 of questions about the UK's proposed ID card scheme, which will use the same 
 technology. The government has not said exactly what will be contained in 
 the ID card's chip, but there will be a National Identity Register that 
 could contain around 50 pieces of information about you, ranging from your 
 name, age, and all your addresses, to your national insurance number and 
 biometric details. Eventually, you may need one to access healthcare. It 
 could even replace the passport. 
  
 Already, then, criminals and terrorists will have identified just how useful 
 cloned ID cards might be. It would be folly to think their best minds are 
 not on the case. 
  
 The Home Office insists that UK passports are secure and among the best in 
 the world, but not everyone agrees. Last week, an EU-funded body entitled 
 the Future of Identity in the Information Society (Fidis) issued a 
 declaration on machine-readable travel documents such as RFID-chipped 
 passports and ID cards. It said the technology was "poorly conceived" and 
 added: "European governments have effectively forced citizens to adopt new 
 . documents which dramatically decrease their security and privacy and 
 increase risk of identity theft." 
  
 The government is now facing demands from the Liberal Democrats and anti-ID 
 card groups for a recall of the passports so that simple devices such as 
 foil covers can be installed - at enormous cost. Such covers would at least 
 stop chips being scanned remotely, though they wouldn't prevent an 
 unscrupulous hotel receptionist from opening the passport and sucking out 
 its contents the way we did. 
  
 It may be that at some point in the future the government will accept that 
 putting RFID chips in to passports is ill-conceived and unnecessary. Until 
 then, the only people likely to embrace this kind of technology are those 
 with mischief in mind. 
  
                                 * 
 ================================================================ 
  NY Transfer News Collective    *    A Service of Blythe Systems 
            Since 1985 - Information for the Rest of Us 
  Search Archives: http://olm.blythe-systems.com/htdig/search.html 
  List Archives:   http://olm.blythe-systems.com/pipermail/nytr/ 
  Subscribe: http://olm.blythe-systems.com/mailman/listinfo/nytr 
 ================================================================ 
  
 -----BEGIN PGP SIGNATURE----- 
 Version: GnuPG v1.4.5 (FreeBSD) 
  
 iD8DBQFFXrMkiz2i76ou9wQRAoVQAKCBKszG4JffCmtsdqGq8kgV9wshEQCeMMEZ 
 QRiH5QCegHBMYS3ZMePdM7Y= 
 =yAdo 
 -----END PGP SIGNATURE----- 
  
 --- SoupGate-Win32 v1.05 
  * Origin: you cannot sedate... all the things you hate (1:229/2)