Privacy, Security & Government Surveillance

The State Department has a notice of proposed rulemaking out on the “card format passport.” They are laying the groundwork for a card-style passport Americans would use when they travel to Canada, Mexico, and the Caribbean.

What’s special about it?: “Vicinity read technology would allow the passport card data to be read at a distance of up to 20 feet from the reader.” That’s right: a promiscuous RFID chip would make your serial number widely available to whomever with a reader might want to know your whereabouts. (The system would not put personal data beyond this identifier on the card.)

If you have concerns about it, the comment period lasts until December 18, 2006. You can e-mail— wait, there’s no e-mail address.

Instead, it says, “Comments by Internet are to be sent to http://www.regulations.gov/index.cfm.” So you must go there and search for the Federal Register notice and submit your comment— wait, they are not accepting comments online either.

This Agency does NOT accept electronic comments for this Federal Register document. You must print out this comment and submit it to the agency by any method identified in the Federal Register document for the rule you are commenting on. The agency’s contact information will also appear on the printed comment form. Your comment will not be considered until this agency receives it. For further information, follow directions in the specific Federal Register document or contact the specific agency directly.

SHARE:

Over on Cato@Liberty, I’ve written a couple of times about how government access to data threatens many new and forthcoming business models.

TechDirt, a favorite tech-business blog, writes today about some ISPs’ perceived lack of cooperation with law enforcement. That ‘lack of cooperation’ is asking for a warrant before revealing customer data. “But requiring a warrant is a check against abuse; without them it’s hard for ISPs to judge the legitimacy and seriousness of a request. By valuing privacy, they better serve their customers, and ensure that law enforcement is only pursuing cases within the scope of the law.”

Very nice to see a business-oriented blog showing how privacy protection nests with commercial interests and good government.

SHARE: 2 comments

Mike Masnick has some depressing news:

Within the security community, there’s been a lot of talk about “security theater” when it comes to the airline business. In the last few years, plenty of new security measures have been put in place–but just because we can see or deal with new security measures (dump your liquids, everyone!), does it actually make us any safer. While there’s been a ton of attention paid in the last week to a security researcher who showed just how easy it was for anyone to create their own boarding pass to get past the security check point, a much scarier story is sent in by Damon, who points out for all of the security changes, new technologies and new processes it doesn’t do a damn bit of good if the TSA screeners let people with weapons through the checkpoint. That’s exactly what happened at Newark airport, where a “secret shopper” (or should that be “secret bomber”?) test found that 20 out of 22 weapons got through the security clearing process. Now aren’t you glad that you have to remove your shoes and can’t bring a bottle of water on board any more? If we’re serious about air travel security, then it’s about time that we actually focused on security–not play-acting to make people think that something’s been done.

Let me repeat that: 20 out of 22 weapons got through. That’s more than 90 percent failure.

The fundamental problem here is that the TSA has no particular incentive to make air travel safer. They have to act like they’re responding to terrorist threats, but as long as they appear to be “doing something,” it doesn’t matter if any of their “security measures” actually accomplish anything. And, not surprisingly, it appears that to a first approximation, they don’t.

SHARE: 2 comments

I have examined the CAPPS program and the fake boarding pass generator in a longish post over on Cato@Liberty.

At the tail end, I say “The fake boarding pass generator does not create a new security weakness. It reveals an existing one. Though some people may want to, it’s important not to kill the messenger . . . .”

Michael Hampton of the enteraining and insightful HomelandStupidity.us quickly pointed me to the views of Congressman Ed Markey (D-MA), which are reflected in Ryan Singel’s post on 27B Stroke 6: Congressman Ed Markey Wants Security Researcher Arrested.

Update: Do check the post on this topic at HomelandStupidity. Scroll down for a YouTube video send-up of identity-based security.

SHARE:

With the holidays approaching, a new program providing greater access to airport concourses is underway. At select airports throughout the country, non-travelers can now enter and meet arriving loved ones, as was routine just a few years ago.

Everyone entering the concourse will still be subject to physical security checks, but the program permits travelers to pass through security and board planes without showing ID to transportation authorities or by using a false/pseudonymous ID.

Has the Transportation Security Administration seen fit to restore convenience, privacy, and freedom to air travelers? Seen the light on identification-based security and relented on ID/boarding card checks? Well, no.

A PhD student in the Security Informatics program at Indiana University has created a generator that anyone can use to mock up their own boarding pass. He notes a number of different uses for it – among them, meeting your elderly grandparents at the gate, or evading the TSA’s no-fly list. So far, it’s only good for Northwest Airlines, but others would be equally easy to design.

Checking the ID and boarding pass is intended to communicate to personnel at the concourse checkpoint that a person has been run past the watch list and “no-fly” list. It provides a sort of second credential, linked by name to the ID of the person who has been reviewed. This spoof easily breaks that link. Fake a credential matching any ID you have, and you are in the concourse.

I wouldn’t recommend using this system without a careful check of the law – if you are allowed to see it. It’s probably illegal to access an airport concourse this way and the TSA would bring the full weight of its enforcement powers down on you if you were caught. Needless to say, making it illegal to evade security is what keeps the terrorists in line.

Hmm. Or maybe security procedures actually need to work.

And that’s the researcher’s point: Comparing a boarding pass to an identification document at the airport does little to prevent a watch-listed or no-fly-listed person from passing (except perhaps to inconvenience him a little more than everyone else). Indeed, identification-based security is swiss-cheesed with flaws.

The first problem is that you have to know who the bad guys are. If you don’t know who is bad, your ID-based security system can’t catch them. If you do know who is bad, you have to make sure that they aren’t using an alias. The cost of doing so may vary, but defrauding or corrupting identity systems is an option that will never be closed to wrongdoers. Making an identity system costly for bad guys to defeat also makes it costly for good people to use. Witness the REAL ID Act.

The linear response to the exposure of this flaw could be to “tighten up” the system – perhaps by discontinuing the use of self-printed boarding passes. The right response is to abandon the folly of identity-based security and use security methods that address tools and methods of attack directly.

There’s plenty on identity and identity-based security in my book Identity Crisis.

SHARE: 6 comments

Interesting question – and perhaps simpler than many people think.

Back in June, the Department of Homeland Security’s Data Privacy and Integrity Advisory Committee (on which I serve) published a draft report on the use of RFID for human tracking.  The report poured cold water on using RFID in government-mandated identity cards and documents.  This met with some consternation among the DHS bureaus that plan to use RFID this way, and among the businesses eager to sell the technology to the government.

Despite diligent work to put the report in final form, the Committee took a pass on it at its most recent meeting in September – nominally because new members of the Committee had not had time to consider it.  The Committee is expected to finish this work and finalize the report in December.

But skeptics of the report continue to come out of the woodwork.  Most recently, the Center for Democracy and Technology wrote a letter to the Privacy Committee encouraging more study of the issue, implicitly discouraging the Committee from finding against RFID-embedded government documents.  CDT invited “a deeper factual inquiry and analysis [that] would foster more thoughtful and constructive public dialog.”

If the correct answer is “no” do you have to say “yes” to be constructive? RFID offers no anti-forgery or anti-tampering benefit over other digital technologies that can be used in identification cards – indeed it has greater security weaknesses than alternatives.  And RFID has only negligible benefits in terms of speed and convenience because it does not assist with the comparison between the identifiers on a card and the bearer of the card.  This is what takes up all the time in the process of identifying someone.   (If that’s too much jargon, you need to read my book  Identity Crisis: How Identification is Overused and Misunderstood.)

I shared my impression of CDT’s comments in an e-mail back to Jim Dempsey.  Jim and CDT do valuable work, but I think they are late to this discussion and are unwittingly undermining the Privacy Committee’s work to protect Americans’ privacy and civil liberties. My missive helps illustrate the thinking and the urgency of this problem, so after the jump, the contents of that e-mail:

Continue reading →

SHARE:

Child predators. Before we go down the road of locking them up and throwing away the key, we should read of this botched raid, by police who had used the wrong IP address to determine who were suspects. Weirdly, Shaquille O’Neal was part of the goon squad.

(ht: Balko)

SHARE: