RFID passport logo (or "mark of the beast"?)

How can you tell if your passport contains an RFID chip?

Look for this logo on the label:

If there's an RFID chip in your passport , identity thieves, terrorists, direct marketers, data aggregators, malicious governments, or anyone else with a radio receiver within 10 meters (30+ feet) or more whenever your passport is read at a border crossing, airport, etc. can secretly and remotely track you, log your movements through the unique "collision avoidance" ID number sent by the chip, and intercept and decrypt all the data (including your digital photo and, in some countries, your digitized fingerprints) needed to "'clone" a perfect copy of your passport, forge other identity credentials, or impersonate you.

All passports that contain ICAO standard (ICAO document 9303) RFID chips (ISO standard 14443) are supposed to have this logo on the front cover, printed or embossed in such a manner that it can't readily be effaced or removed without leaving conspicuous traces. Border guards and immigration inspectors need to be able to distinguish quickly and reliably between a (valid, for the time being) passport that never contained an RFID chip, and an invalid (under current USA regulations and, I expect, similar regulations in other countries that are putting RFID chips in passports) passport that contains a defective or disabled RFID chip.

A visible logo is needed because the RFID chip might not otherwise be readily or reliably detectable. When I felt the sample RFID passports passed around at CFP 2005 by Frank Moss , director of the Passport Office of the USA Department of State, I could (just barely) detect the RFID chip embedded in the cover by its stiffness when I bent the cover sharply and rolled the bend back and forth across the width of the cover page. But if I were a government agency, I wouldn't want to rely on that. The chip or antenna might fail if the cover was bent sharply every time the passport was checked. And the Passport Office reportedly has been shopping for smaller chips less prone to breakage in the laminating and binding machinery, which would also be harder to detect by feel.

The RFID passport logo was prominently printed or embossed on the cover of all of Moss' sample RFID passports, immediately below the words, "United States of America" -- but without any indication, anywhere in the passport, even in the finest print, that would tip off those not already in the know as to what the logo means.

The ICAO technical documents include an entire paper on the RFID passport logo, the need for standard RFID indicia on passports, and the discussion of which of several proposed logos to adopt. But none of those proposed logos, much less which one was ultimately adopted as the standard, are reproduced in the file on the public ICAO Web site.

The USA State Department mentions the logo in its "FAQ on RFID Passports", and even includes a hyperlink to an image file -- that doesn't exist at the specified location. But I found an image file with the same name, which I recognized and remembered from Moss's sample RFID passports at CFP, in another public directory elsewhere on the State Department Web server. Here's how the Passport Office describes the logo and its use:

What is the Electronic Passport logo and what does it mean?

The Electronic Passport logo (shown at the right above) is the international symbol for an electronic passport. It signifies that the passport contains an integrated circuit or chip on which data about the passport and passport bearer is stored. The logo will be displayed at border inspection lanes at all airports and transit ports equipped with special data readers for Electronic Passports.

RFID has acquired deservedly negative connotations with the public. In response, the USA State Department, ICAO, and European proponents of RFID chips in identity cards all use the Newspeak "electronic passport" or "e-passport" for passports containing embedded RFID chips, and "contactless integrated circuit" for the ISO 14443 standard RFID chips themselves.

The State Department will probably say that the broken link to the logo in it's FAQ is an innocent error. They haven't returned my phone calls seeking comment on this as well as on what, if anything, they plan to do in response to the news of Dutch experiments in which similarly-encrypted RFID passport data was remotely intercepted, the encryption scheme cracked, and the data recovered. But it appears that they want to be discreet with the public about the meaning of this logo.

Why?

Some people think RFID chips are the mark of the beast mentioned in the Christian bible. I suspect that the State Department, and perhaps others, are afraid that some of these people might interpret the RFID logo as its own sort of "mark" of the Beast, and object to having to carry it on their passports. Whatever you think of their beliefs, they might pose a problem for a government that claims to be faith-based and Christian and that has been steadily enlarging the exceptions from government regulations for the "free exercise of religion", especially if that religion is Christian.

There's even some interesting case law to support religious objections to displaying government "marks", most notably Wooley vs. Maynard (430 U.S. 705), the 1977 case in which the Supreme Court upheld the right of a religious pacifist to cover over the "Live Free or Die!" slogan on their New Hampshire motor vehicle license plates. Coincidentally, both the National Passport Center in Portsmouth -- probably the site of the USA's first production line for standard RFID passports -- and one of the most active chapters of CASPIAN -- the leading opponents of non-consensual RFID use in the USA -- are located just a few miles apart in southeastern New Hampshire. [Addendum, 17 May 2006: Some more recent information suggests that the first standard RFID passport production line in the USA may be at the second, but expanding, National Passport Center in Charleston, SC. But we won't really know until we start seeing them. Passports issued either in Portsmouth or Charleston say only "national Passport Center" as the place of issuance, so take note of the postmark on the envelope in which you receive your new passport.]

In a recent report on this, Boing Boing said that, "The US State Department has said that RFID-chipped passports will not be issued to travelers 'until privacy-related concerns have been addressed.'" That's what the State Department said when it first published its proposed regulations. But don't get the mistaken idea that RFID deployment in USA passports is on hold -- except to the extent that it has been delayed by the unreliability of the chips and readers -- or that privacy concerns have actually been addressed. The State Department put the final regulations into effect later last year with only minor and ineffectual changes -- such as the addition of the "Basic Access Control" encryption scheme for some of the data (but not the unencrypted unique ID number) that has already been cracked .

So what can you do if you get a new passport with an RFID chip? (Did I mention that you have no choice about whether you'll get chipped passport, and no way to tell when you apply if you'll be one of the guinea pigs?)

You can't disable the RFID chip without voiding your passport: "Any passport which has been materially changed in physical appearance or composition, or contains a damaged, defective or otherwise nonfunctioning electronic chip, or which includes unauthorized changes, obliterations, entries or photographs, ... may be invalidated."

You can carry your RFID passport in a tin-foil hat: At least one company is already selling RF-opaque wallet inserts to hold credit cards or similarly sized items with RFID chips, and they've told me their next product will be a similar but larger optically transparent RFID shielding passport cover. As one of its "concessions" to critics, the State Department is adding RF shielding to the outer cover of the passport. But that won't protect it from RF interrogation and reading whenever the cover is opened for visual inspection of the data page. With an add-on sleeve like a book cover that the passport cover slips into, the passport could be opened for visual inspection of the inside data page without exposing the chip in the cover to RF reading. Even that, however, won't protect against the attack used in the recent Dutch cracking demonstrations: eavesdropping on the radio exchange between the chip and a legitimate reader at a border crossing or airport, where you are forced by government order to allow the RFID chip in your passport to be read.

There's no apparent "technical fix" to the security risks of RFID chips in passports; the problem requires a legislative fix to prohibit use of RFID chips in identity credentials or their nonconsensual or undisclosed commercial use, and to enact a comprehensive data privacy law in the USA to prohibit the use, sale, rental, or sharing of personal data about us acquired (through use of RFID chips, in the course of commercial transactions, or otherwise) by "private" entities, without our permission, without our knowledge, or for purposes other than those for which we originally provided it. That's what the law requires in Canada and the European Union, and what it should require in the USA. And none of those countries, or any others, should be endangering their citizens by putting RFID chips in passports.

In the meantime, if you do find this "mark" on your passport, please let me know about it. It would help others to know when and by which Passport Offices these start being issued. And I know several technical experts who would be very interested in testing RFID passports "in the wild", to see if the attacks demonstrated against Dutch passports with RFID chips will also work against similar USA passports, and what other vulnerabilities they may have.

[Addendum, 2 February 2006: The link on the State Department Web site for holders of USA passports is still broken. But once I knew more about what to look for, I found smaller images of the logo on a Department of Homeland Security Web site on passport requirements for visitors to the USA, and in a later version of one of the ICAO technical reports. I also found high-resolution photos of Australian passports with RFID chips (note that the Australian passports have the chip embedded in an inside page, rather than in the cover as in the prototype chipped USA passports), and several smaller images of the RFID logo and its use on chipped Thai passports . But still no pictures of the cover of an RFID-chipped USA passport.]

[Further addendum, 3 February 2006: Blank RFID-chipped passports that could be used to forge passports with "cloned" RFID chips are already in criminal circulation: AllAfrica.com and This Day newspaper report today that more than 2,000 RFID-chipped Nigerian passport blanks were stolen from the headquarters of the Nigeria Immigration Service (NIS)in the capital city, Abuja, even before the NIS had its own equipment in place to issue the first "e-passports" using these blanks. Some of the stolen blanks were reportedly seized and recovered while being shipped to Europe, but it's not clear if all of the stolen blanks were recovered. And there's no reason to think there won't be, if there haven't been already, more thefts elsewhere.]

[Further addendum, 6 February 2006: I guess the USA State Department reads this blog: Now that I've let the cat out of the bag by posting the logo, they've fixed the link to the image of the logo on their Web page about RFID passports.]

[Further addendum, 1 August 2006: see pages 29-31 (31-33 of the PDF file) of the 2006 inaugural issue of the Machine-Readable Travel Documents Report for ICAO's specifications and explanation of what it calls "the ChipInside symbol".]

CHECK IT OUT, AMERICA:

http://hasbrouck.org/blog/archives/001003.html