Smart Card Alliance Urges States to Put Security, Privacy First Concerning Enhanced Driver’s License

PRINCETON JUNCTION, NJ - The privacy and security of U.S. citizens would take a back seat to convenience if border states follow the U.S. Department of Homeland Security (DHS) recommendations to pilot long-range, vicinity-read RFID-based state driver’s licenses that would double as border crossing cards, according to a statement released by the Smart Card Alliance.

The Alliance recommends that states working on enhanced driver’s license pilot programs with DHS retain their right to contribute to the technology specification and consider using more secure contactless smart card technology. This is the same technology used in new, government issued e-passports. It would help states to achieve a fast and secure means for citizens to cross U.S. land and sea borders under the new Western Hemisphere Traveler Initiative (WHTI) guidelines.

“The Smart Card Alliance, whose members provide both secure RF contactless smart card and RFID products, supports efforts by border states to boost security at borders while facilitating trade and tourism,” said Randy Vanderhoof, executive director of the Smart Card Alliance. “However, we also believe that states should not lose sight of the concerns raised by numerous privacy and security groups about the DHS stated intent to put the same RFID tracking technology used for packages and pallets into driver’s licenses.”

As a result of WHTI, DHS and the Department of State are considering creating a new type of border crossing card for U.S. citizens as a lower cost alternative to passports. But the program sparked controversy and raised privacy, security and operational issues when DHS recommended using long-range RFID technology in a notice of proposed rule making last year.

There are performance concerns with long-range RFID as well. A high-level government report reviewed DHS use of the same RFID technology in the US-VISIT program, and concluded that “initial testing and analysis of this has identified numerous performance and reliability problems, such as the failure of RFID readers to detect a majority of travelers’ tags during testing.” Successful read rates were low at four of the five test sites, and in one instance as low as 27 percent. Thus, if DHS recommends the same solution for the enhanced driver’s license, border crossing wait times may increase for travelers.

The first state to sign a memorandum of agreement with DHS was Washington State. Though it does not specify the technology for the enhanced driver’s license, the agreement has the provision that DHS alone will be responsible for providing the technology specifications. If DHS proposes the same technology solution for the enhanced driver’s license as they recommended for WHTI, the same issues of privacy and security would come to the fore.

The only broadly deployed, proven technology existing today that meets the objectives of increased border security, citizen privacy and efficient border crossing is contactless smart card technology -- the technology that is being used by the United States and more than 26 other countries for e-passport. The same smart card technology is specified for all new federal employee ID cards beginning this year and is being widely used in identity management applications worldwide.

Smart card technology uses cryptographic techniques that would ensure that the enhanced driver’s license is authentic and prevent tampering and forgeries. It would also allow for cryptographic protection of any personal information stored on the driver’s license and communicated during identity verification.