WA licenses have RFID, antenna, upsetting privacy advocates
Washington state drivers' licenses will soon have a bar code that can be read without the driver knowing anything is going on -- and that has privacy advocates concerned, reports the Seattle Times.
The new licenses and ID cards contain a computer chip and antenna that are used to store and transmit data remotely through radio waves. These RFID tags have the ability to be read remotely, while moving in the dark, and even through material.
Privacy advocates say the new licenses, which are to be issued next year, need better security to protect against unauthorized tracking of individuals.
The new licenses were Gov. Gregoire's compromise to the DHS' tough border regulations. Instead of passports required between the U.S. and Canadian borders, the DHS requires licenses containing RFID tags, said Antonio Ginatta, the governor's executive policy adviser.
The very attributes that make the RFID technology appealing make it inherently insecure, said experts at a policy roundtable on RFID held Thursday at the University of Washington Law School.
"Now if I show my license, somebody has to ask me for it and I can see what they do with it," said Christina Drummond, director of the state ACLU's Technology and Liberty Project. "With RFID licenses, we wouldn't necessarily have that ability."
The enhanced Washington driver's license carries a microchip that does not have personal information, but it does have a code that customs officials can then use to pull up records from the Department of Licensing database.
Privacy advocates would prefer it if the licenses could only be read if touched by an RFID reader to transmit information or contain a switch to disable it.
"Is there really any reason to read an RFID tag in a driver's license without touching it?" asked UW computer-science professor Gaetano Borriello. "I can't think of any. Why are we even putting an antenna that allows long-range reading of a driver's license? It's just silly."
As a result of this new technology, the ACLU has drawn up legislation that requires noticification and consent before third parties can collect personal information, imposes limitations on gathering information, forbids tracking of individuals, protects the security of unique numbers used to identify people in electronic transactions, and holds businesses and government liable for invasions of privacy.
"It's risky at best not to pursue stronger legislation," said Evan Welbourne, who has been researching issues around RFID through an interdisciplinary group at UW. "The question shouldn't be whether to ban RFID or not, but how do we deploy and regulate it in a way that is effective and privacy-protecting?"