Stopping an electronic pickpocket

scanner. We’re also talking about your employee ID/building access card, your automatic highway toll pass, your public transportation card, the newest wave of credit cards and gas purchasing cards, even digital drivers’ licenses being developed in some states.

All of these nifty bits of plastic employ versions of radio frequency identification technology, or RFID. That is, they toss out bits of data that are caught by receivers, with little or no contact, just through the air in some cases. The new credit cards, such as MasterCard’s PayPass, don’t even have to be swiped through a machine: You need only lightly tap the PayPass on a terminal to register a purchase.

Neato. It feels as if you’re living in the future. Alas, just as every problem has a solution, so every solution has a problem, right?

According to some security gurus, even when there is no receiver in the vicinity, your digital secrets are leaking merrily from the cards in your wallet, like sound from a radio that you can’t turn off. So, conceivably, a pickpocket with a laptop and an antenna could lift the digital contents of your wallet. This modern Artful Dodger would never reach his fingers under your jacket. He’d be that guy with a backpack slouched on a bench in a subway station or airport, vacuuming up bits and bytes as crowds flowed past.

Paranoid? The makers and issuers of RFID cards insist the data are encrypted and safe. Yet some security watchdogs assert the need to cover, or shield, these cards when they aren’t in use. A thin metalised nylon can do the trick, based on the classic Faraday cage design, to disrupt RFID communications. “If I had an RFID that didn’t have a cover, a driver’s license, a credit card, a corporate ID card . … suddenly a (shielded) wallet isn’t such a stupid idea,” said Schneier, an author of books on security and the chief technology officer of California.-based BT Counterpane, a network security company.

A couple of years ago, when the State Department announced the new style of passports, EPIC recommended that people wrap their passports in tinfoil. Instead, the State Department addressed such concerns by embedding metallic shielding in the front and back cover of the passport books. In addition, the new “passport cards” to be offered to US citizens who travel frequently between the United States and Canada, Mexico or the Caribbean will come with similarly shielded sleeves.

The fact that the State Department has resorted to shielding material—does that mean the threat is real, that shielded wallets for other types of cards are a good idea? Schneier, for one, thinks the passport books are still vulnerable when they are open.

But spokesmen for the State Department and the Department of Homeland Security say the shields are just an extra level of security for documents that are already safe because of encryption and the nature of the information on them. Even when the passport books are open, the digital information can be read by a scanner no more than a few inches away, said spokesman Steve Royster. As for the passport cards for frequent border-crossers, they can be read at 20 to 30 feet but contain no personal information, Royster said. The personal stuff is safe in government computers, he said.

MasterCard said consumers need not invest in shielded wallets. “All of our cards go through very strict security testing,” MasterCard spokeswoman Erica Harvill said. The data on the cards are encrypted using a system involving random, unique authentication codes that can be used only once, Harvill said, and the signals can travel only a very short distance.
-David Montgomery(The Washington Post)