Have chip, will travel

Why chips in passports and ID cards are a stupid idea

See article

Readers' comments




This reminds me of a point once made by the computer scientist Joseph Weizenbaum: "The act of automating doesn't solve problems. It just automates them."


RFID industri is having trouble taking off. When commercial succsess is not available they have turned to politicians. To get them going they have deployed lobby groups to make governments require RFID tags on grand scale in government issued identifications.


Actually all this technology is obsolescent (which may be why the industry was keen on the contracts). We (nearly) all carry a mobile phone that can be tracked and thus identified in many simple ways as genuinely yours (even a PIN might be enough - after all it cannot be read remotely as facial details of course can be). And the ability to find it at any time solves a lot of 'border' problems. It is intrinsically stupid (sorry!) to have the ID data on the ID unit carried - any such system can be cracked. Requesting ID (eg a photo etc) when needed from a central database is not perfect either - but it is a lot better.

Of course whether you want the government to actually have a reliable secure way of identifying and tracking you may be another question...


RFID gives the benefits of convenience: no need to accurately place whatever identifying marks you use. The tradeoff is reduced security: instead of having to have the active consent of the owner to display information, it can be displayed remotely without the user's knowledge.

Why passports of all things would use technology that reduces security for convenience is beyond me.


"It is misleading to imply, as the writer does elsewhere in the article, that a passport can be "read" just because it is partially open."

The article explains this, saying that common characteristics of encrypted data from passports of the same nationality could be identifiable, and used to target nationals of a particular state.


This is finally something the old ECONOMIST would publish!

And it would have been great!

And it would turn out that the PFID would have it on camera; the act of "buying off a certain US Senator from Illinois with his support of new and improved US passports, and somebody's halo suddenly slips, and the fight is on! Only this time the fight is between the Liberal's and the Libertarian's. Obama, exposed as a fraud, has his popularity plunge into the low forty's, and, trickle's down into the mid thirty's....

Employment numbers get officially messaged Again, and while unemployment stayed steady, lots of people lost their jobs! Oil goes up! Confidence goes down! That's the old Economist!

I could go on, but my wife thinks I think too much...


The Sydney airport has an automated immigration line? Do they have facial recognition software that compares your face with the biometric data of the passport? Even if they do this is a glaring security breach. Contrary to what the movies teach us, computers are not difficult to trick. At least not the ones delivered on a lowest cost bid basis.

As any hacker knows the weakest link in a security system is the human. Why guess a password when you can usually get someone to log you onto a system? Take one attractive person of the opposite sex, one airport bar and one pickpocket and you can get any passport you want. You now have the optical bar code, name and picture. You can automatically force feed the passport security keys until one of them opens the rfid chip. I highly doubt the rfid chip can lock you out after three tries. You have now unlocked the passport and are free to return it to the unsuspecting mark. You should be able to use this information to make your own passports.

But a good immigration officer can spot a fake passport you say. Not in a few years when they have all been trained to believe the computer. The computer says it is good. No reason to examine the paper document itself to see if it looks real. But on the bright side look at all the money we will save. No longer do you need a skilled and costly immigration officer. All you need is a low paid drone who believes the computer.


Not to put to fine a point on this, BUT

In the last three months I spent a lot of time on the streets of both Cairo and Dubai, in positions were I was surrounded by unhappy disgruntled men who looked to me as though they were religious fundamentalists. While it was obvious to them I was a foreign national, it was not obvious I was a US citizen--I was keeping my mouth shut...

But, to have something in your pocket that automatically responds to an electronic signal, that literally BROADCASTS your US citizenship, is someday going to be the basis for a group of tourists being killed.

Now, as an employee of the US government, I have just acquired another new form of identity card, one that has the same chip, one that will broadcast as well, and it carry's a different set of biometrics; my fingerprints, plus whatever (they won't say-they honestly mumble when they tell you what else it carries). And it's supposed to have buried within it, about a zillion specific aspects of my job; including clearance levels, pay scale, computer access, etc...

NOW, having to carry this ID badge around on my neck does not do my basic low level paranoia any good. At least they spent time and took a couple of pictures in order to get a good one. (They didn't like the "deer in the headlights" look that I had on my first picture). Plus, I hate how the color of my hair is now officially described as 'grey'.

Plus, it can't go in your wallet, and it needs it's own carrying and 'cloaking' device, and the transponder is prominently displayed... Yea, it's special, and that means that I'm special, but all it means to me is that the sorting process will go faster when I finally arrive at my own personal Dachau.

Encrypted. RIGHT.


Sorry,I have not used this card so far,but I have learned more infomation for this article,I think the security is the most important for every one.thanks!We should improve it from the aspect of security.


As the author notes in one place in the article, the passport data is encrypted, and so cannot be read at a distance just because it is "partially open". It is misleading to imply, as the writer does elsewhere in the article, that a passport can be "read" just because it is partially open. Of course, the encryption can be hacked, if the bar code is known or partially guessed, but all one would obtain is the facial biometrics. While I agree the utility of the system is in question, the article is really a bit overblown.


The automated immigration line at Sydney airport, "Smartgate", does in fact have facial recognition software which matches the facial image in your epassport with your face. If a perfect match is not obtained then you will be referred to a Customs officer for manual processing. Smartgate also authenticates the data in your epassport by checking the digital signature to make sure there has been no tampering of the facial image or the personal details. There is no glaring security breach.

The "optical bar code" on the data page of the epassport is actually two lines of Optical Character Recognition (OCR) printing. It helps to get the terminology correct if you're hoping to convince readers of your technical expertise.

"Force feeding the passport security keys", or trying to guess the Basic Access Control key to get access to the chip, is not necessary if you have the epassport physically in your possession. The key is a composite of the document number, the date of birth and the date of expiry. This is how the system is meant to work. Otherwise border control in other countries would be unable to read your epassport.

If you don't have the epassport physically in your possession, so that you don't know the two lines of OCR, trying to guess the Basic Access Control key is not practical as it would take far too long. This is even true if you know the approximate age of the holder, such that you can estimate the date of birth.

Of course you can make your own passport by copying the chip. It's about as useful as photocopying a traditional passport. Photocopies tend not to have all the security features of the original. As well, there is a security feature of epassports called "Active Authentication" which detects cloned chips. Also any change of the facial image or personal details in the chip will invalidate the digital signature and be detected.


Why RFID? The frequency range is wider than other contactless technologies, such is myfare chips, which needs a short distance to read the data. I don´t understand why the RFID was chosen.



You say you are an employee of the US government. I would say that you sound more like a disgruntled employee. ;-)


So what's the entire point having a passport in the first place? The technological strides in biometrics should at the least have made identification via chips or traditional passport a redundant exercise. A simplistic data system that consists in eye-irises identification/scan as input, and a global identification number flashed on the immigration officer's output display could make the checks in borders less energy-sapping and time-consuming. Travelers going accross borders would thus not require some lousy passport...i mean it seems that the long talks about globalisation isn't really entirely pragmatic,..there's a claim to global integration but a seeming subscription to a roundabout delay system of passport presentation: whether it's a traditional version or a''chipped'' series.

Svyatoslav Pidgorny

RFID does make passports harder to counterfeit. In fact we have yet to see full copy of an RFID passport - not only harvesting for selected attributes.

The information that is contained on the passport RFID chip is not really private information. Unless you're wearing a burqa, anybody can see your face, wirelessly.

And using RFID passports does speed up immigration process. In Sydney airport there is no immigration officers in the ePassport lines - it's all automated.


I am surprised that the Economist would publish such an ill informed article. In its 19 paragraphs, I counted 16 fallacies. It seems that the author googled "epassport" and reprinted every misconception, half-truth, and untruth that have appeared in the past 5 years.



Products and events


Take our weekly news quiz to stay on top of the headlines

