Identification Please: Is Your Passport Leaking Sensitive Information?

If you’ve ever traveled internationally outside the United States then chances are, you’re familiar with the passport you were required to obtain before traveling. While the passport is a simple means of identification and tracking visas, many people just consider their passport as such and don’t pay much attention to it when traveling. Unfortunately, passports may be providing information to strangers without you even realizing it.

RFID Technology in Passports

In 2007, the State Department started including an RFID (Radio Frequency Identification) chip inside every passport issued. This chip (denoted by the mark in the photo below) contained a digital version of the passport information, including a photo. They cited the need for increased security and preventing fraud with passports as the reason the chips were installed.

We’ve covered RFID technology in the past and the possible insecurities it carries with it, so this is something to be concerned about. For those unfamiliar with RFID, it’s basically a passive chip technology that allows scanners within range to receive the data contained on it. While the scanner does need to be in close proximity, (a few feet) there’s no indication from the RFID chip that data is being scanned. So someone with an RFID reader could scan the chip inside your passport without you being aware of it.

In this article from CNET, a representative from the State Department responded to security concerns surrounding passport RFID chips and stated that even if the data were to be cloned, other security features like the use of Basic Access Control cryptography, would foil would-be impostors . BAC requires authentication before allowing access to the data. Furthermore, they also claim that the RFID chip can only be scanned when the passport is open, due to the RFID blocking elements contained in the cover.

While this may be the case, anyone that’s traveled internationally can tell you how often the passport must be held open while traveling. There have also been tests performed on RFID blocking devices and the results show that if the device isn’t completely sealed up, the chip can still be scanned. With passports never completely sealing, there’s a chance that the data could still be scanned, even when closed.

What Can Be Done?

If you currently have a passport containing one of these chips, you have a few methods of disabling the chip. The best and most non-invasive method is the use of a completely sealed RFID blocking device. This is a good thing to have with you when traveling as you can also keep your RFID enabled credit cards and keyless entry systems in there.

Looking for a more permanent method, some people have gone as far as placing a swift “percussive adjustment” on the section of their passport containing the RFID chip. While the State Department does not allow any tampering to a passport, they’ve said that the passport is considered valid even if the RFID isn’t working. However, if there are oddly shaped wear marks or any sign of tampering, they may consider the passport invalid, so keep that in mind.

The Passport Card

Recently, the State Department introduced the new Passport Card as an alternative identification to those traveling to Canada and Mexico by land. Rather than the full information contained in the Passport Book, the RFID chip contained within the Passport Card only stores a unique identification number that corresponds with information held in a government database. Bryan recently received his new Passport Card and shares his thoughts on the process below:

Bryan Black: If you’ve been reading ITS long enough, you may remember this article I wrote quite a few years ago on obtaining a duplicate passport. While I’ve never gotten around to getting a true duplicate passport, I have finally taken the time to obtain a Passport Card. Let me tell you, the process made me quite nervous.

First off, as Rob mentioned, the Passport Card has limitations. It is a form of government identification and can be used as such, but can’t be used for international travel by air. However, it can also be used for land border crossings or sea ports-of-entry into Canada, Mexico, the Caribbean and Bermuda. You can of course get back home with it too.

It also gives you a limited backup passport if you’re only traveling to the places I outlined above, as you can leave your standard Passport Book locked in the safe at home. The Passport Card does contain an RFID Chip embedded inside and comes with a protective sleeve, but I have my doubts on the paper sleeve blocking RFID readers. I’ll be keeping mine in the ITS RFID Wallet Sleeve, even though Passport Cards only contain a unique number rather than the complete information that the Passport Book offers.

The process for obtaining a Passport Card was nerve racking, I’d suggest paying the extra money when you purchase a Passport Book and get the card as well. If you have just a standard passport and want to add the Passport Card, you not only have to fill out paperwork to mail in (including payment) with new passport photos, but actually send your Passport Book through the mail with the application.

It only took about 4 weeks to do this, but being without my passport made me anxious, especially when I received the new Passport Card in the mail with a note that said my original passport would be shipped in a separate envelope. After another 5 days of waiting, I was just about to call the Dept. of State, when it showed up. This is exactly what I mentioned having a duplicate passport would be good for in my article years ago, maybe I’ll finally take my own advice and get that duplicate.

The Future of Passports

Even after everything we’ve said above about the RFID chip in your passport, the likelihood of someone being able to read the information and tamper with it is relatively low. However, we’re not as concerned with that aspect as we are about the fact that you have to retain a passport for 10 years.

This means that the RFID technology in your 2007 passport will be 10 years old before you’re able to renew. With all the technological advancements we’re making these days, the concern is that RFID could be become compromised on a large scale and millions of passports would be made vulnerable.

That’s the issue with technology like this, the “it’s probably fine” attitude isn’t good enough. There are people somewhere working on a method to extract more information from this technology at a larger distance. Rather than hoping that they don’t succeed, take matters into your own hands and protect your data to the best of your ability.