Thursday, October 07, 2004

Virginia Wary of Computer Chip Cards

Virginia wary of computer chip cards packed with detailed data
Associated Press Writer
October 6 2004

RICHMOND, Va. -- You stroll into a mall and sensors automatically log the time and date of your visit because a high-tech driver's license in your wallet electronically emits data about you.

The same card, embedded with a computer chip, allows the guy using a laptop outside the coffee bar to sniff out details as personal as your blood type and allergies and, at least in the virtual world, become you.

Orwellian in the extreme and unlikely any time soon, those kinds of scenarios nevertheless trouble policymakers in Virginia and other states trying to balance homeland security with the threat such technology poses to privacy and civil liberties.

"This is something we're all still trying to understand, however, I still believe we have an obligation as a state to look into the technology that is available ... to protect the privacy and security of the citizens of the commonwealth," said Del. Kathy Byron, head of a legislative panel studying "smart" drivers licenses.

Virginia is particularly sensitive to tightening security for its drivers licenses. Several of the Sept. 11, 2001, hijackers fraudulently obtained Virginia licenses and used them to prove their identities at airports and flight schools. The state recently enacted a law that requires license applicants to prove they are in the United States legally.

But change comes slowly to the Old Dominion--a state that has repeatedly rejected intersection photo technology to catch drivers who run red lights.

"I don't think anyone would stand here today and say we're ready to recommend something. We have a lot to wade through," Byron said at a meeting Wednesday.

Other states have also been skeptical. In Utah, strong concerns about privacy united groups on the left and right to a defeat a smart drivers license effort there in 1996. For similar reasons, New Jersey rejected smart drivers' licenses in 2000, and the idea never got off the ground in New Mexico in 2001, according to the according to the American Association of Motor Vehicle Administrators.

The licenses offer clear benefits for law enforcement and national security, said Bedford County Sheriff Michael J. Brown, who is on the board of directors of the National Sheriffs' Association.

They can be made much more tamper-resistant than current printed cards and they can allow police on the beat to instantly track traffic or criminal violations. By loading them with biometric data such as a digital version of the user's fingerprint or iris scan and requiring that they match those of the card holder, smart cards are almost foolproof for confirming identity. Medical data on them can tell paramedics the holder's blood type or what drugs provoke an adverse reaction.

"We in law enforcement want every break we can have, and this will be a break that will aid law enforcement," Brown told Byron's panel.

Civil libertarians, however, warn that the more information packed onto such a card, the greater its danger for abuse, particularly so-called RFID cards that use a weak radio frequency to send data to a wireless card reader nearby.

Such chips would create a security nightmare, said Christopher Calabrese, the New York-based counsel to the American Civil Liberty Union's Technology and Liberty Program.

"An identity thief would be able to electronically pickpocket the information in your RFID chip without ever stealing your drivers license," Calabrese said. "If they had a reader, they could pick through your wallet, through your backpack, through your purse and pluck the information off the chip."

It could be employed by tech-savvy stalkers, or a Big Brother government could use it to instantly learn the identities of every cardholder at a protest rally, Calabrese said.

Such cards exist, said Robert Turbeville, a vice president of Saflink Corp. The company manufactures a variety of smart cards for security-sensitive agencies such as the Defense Department. But nobody recommends cards capable of being remotely scanned for driving licenses, he said.

Aside from security concerns, he said, such cards would eventually cause health problems such as cancer from prolonged, close exposure to electromagnetic radiation.

There are more practical concerns, warned Rich Carter, director of technology standards and programs for AAMVA.

Smart card licenses will cost the state about $5 to $10 apiece to create, four to eight times more than the current costs, and police and agencies will have to be outfitted with card readers and other equipment, which can run into the hundreds or thousands of dollars. And no matter how much data they contain, they're only as good as the motor vehicle agency worker responsible for spotting impostors.

"The terrorists of 9/11 fell into the category of what we would call impostors, and the only way to guard against that is to improve your processes before you issue the license," Carter said.

Byron's panel is supposed to report to the General Assembly by November. Byron said meeting the deadline is unlikely because this year's legislative session lasted nearly twice as long as its scheduled 60 days, throwing the subcommittee months behind.