What Lies Beneath: The Importance of Maintaining RFID IDs:
Who Benefits and How?

Courtesy of the AIM Global Newsletter, October 2005

The recent furor caused by U.S. California State Senator Joe Simitian’s proposed three-year moratorium on RFID-enabled ID cards has obscured two rather fundamental questions: what are the specific kinds of information that should be encoded on an RFID-enabled document and what specific benefits would the holder and issuer gain from this form factor?

 At the moment, these are questions that may not have simple answers since each type of document should be examined individually. The root of the debate was caused by an implementation of RFID in school identity cards that was not well thought out and exposed students to danger through the prominent display of their names on the tags, not the RFID component. [The RFID issue was brought up after the initial furor over the student’s name and photo on the ID cards but was the only issue that captured media attention.]

Most of the concerns expressed to date have been over hypothetical applications and equally hypothetical potentials for abuse. Existing uses of RFID—for college ID cards, for building access and library use, for example—contain only a “license plate” number and are designed to benefit both the holder and issuer.

In libraries, the RFID component speeds up the check-in or check-out process, improves accuracy, and reduces theft. (Books that are stolen can’t be checked out by anyone else and the cost of that book must be paid by the library which is typically on a tight budget to begin with. So, the book might not be replaced or, if it is, another title can’t be purchased.)

For college IDs, many schools are moving to contactless smart cards that also serve as stored value cards. These facilitate entry to buildings (because they don’t need to be inserted into a reader), speed charges or validation in cafeteria lines and reduce a student’s need to carry cash which reduces the likelihood of being robbed.

In both these situations, there are clear benefits to both the issuer and the holder.

However, when it comes to documents such as drivers’ licenses, the questions need to be asked: who benefits and how?

For law enforcement officers, it might seem that a contactless read of a drivers’ license might make things a bit easier if he or she is juggling a handheld terminal and flashlight during a traffic stop at night—but if the license is in hand already, what’s the benefit of reading data in a contactless manner? In fact, it might actually complicate things. Now the officer has three things to juggle—the license, reader and flashlight. Inserting the license into a reader to read the data from the existing PDF 417 symbol (or some other 2D symbol) on the license would also secure the license until the officer was ready to return it.

RFID could serve to validate the authenticity of the document since the Tag ID (TID) is a globally unique number that can’t be changed and is very difficult to counterfeit. But the TID would have to be verified via a remote database to match it against other information on the license which would mean communication between a handheld terminal and the remote database (for all 50 states and Puerto Rico) either via a wireless link to the patrol vehicle’s radio or via cell or WiFi. Here, it’s a matter of how many potentially fake or altered drivers’ licenses exist. In other words, is this a major problem requiring a high tech solution?

Perhaps having a photo encrypted in an RFID-enabled license could help ensure the document’s validity. But this biometric information could also be encrypted using a 2D symbol.

Perhaps the most useful application might be for proof-of-age to speed checking of IDs as patrons enter bars or try to buy cigarettes or alcoholic beverages. Hand-held terminals that flash the ID holder’s photo (for visual comparison) and a go/no-go light would make checking IDs much quicker and more accurate. And would remove any possible excuse for “making a mistake” in calculating the holder’s age.

Only if a state-issued ID were to be used to improve security or even gain access to, say, sporting events would contactless reading be a real benefit. Known trouble-makers, those with outstanding warrants, and other previously identified miscreants could be quickly identified and excluded or taken into custody.

So, while the potential threats to personal security and privacy of RFID-enabled documents are primarily hypothetical and, in many cases not physically possible, the data to be encoded/encrypted, and specific benefits, have not been identified in any concrete manner. And that just makes the job of the technology’s opponents all that much easier.

For more information, please visit www.aimglobal.org.