Smart Card Alliance Calls For Review Of EPC Gen 2 RFID In Identity Documents

Recent headlines have confused U.S. electronic passports -- the passport books with the blue cover and the small gold e-passport icon -- with the new U.S. Passport Cards and Enhanced Driver’s Licenses (EDL) already being issued as border crossing credentials by some states.

The confusion came in reports about security researcher Chris Paget, who demonstrated the ease of scanning, cloning and tracking RFID-based U.S. Passport Cards and Enhanced Driver’s Licenses (EDL) in a YouTube video.

“The Smart Card Alliance wants to make it clear that this demonstration did not involve the blue U.S. electronic passport books,” said Randy Vanderhoof, executive director of the Smart Card Alliance. “Headlines stating that passports can be scanned and tracked are wrong. The widely reported demonstration involved U.S. Passport Cards and Enhanced Driver’s Licenses, which use EPC Gen 2 RFID technology. These are different travel documents and use completely different technologies from U.S. electronic passports, which use contactless smart card technology and are very privacy secure.”

With the coming of the new administration, the Smart Card Alliance recommends an immediate review of the decision to use EPC Gen 2 RFID technology in U.S. travel documents. The Alliance is prepared to endorse the correct use of any technology that provides adequate protection of privacy and identity information. However, as the U.S. Passport Card and EDL programs were being defined, the Smart Card Alliance went on record advising against using an insecure EPC Gen 2 RFID solution that put the privacy and security of U.S. citizens’ personal information at risk.

The Alliance Identity Council, whose members include technology providers of both RFID and RF-enabled contactless smart card solutions, stands ready to assist any government agency or department that undertakes such a review. The Alliance provides a cross-industry forum that can offer expert advice on how to best meet the needs of high security and throughput at border crossings without compromising the privacy of citizens’ personal information or their safety.

Passport Cards are new, State Department-issued travel documents valid primarily for crossing land borders with Canada and Mexico. They were designed to provide a less expensive and more portable alternative to the traditional blue passport book. Some border states are issuing or planning to issue special driver’s licenses, called Enhanced Driver’s Licenses (EDL), that are also valid for crossing land borders. The State Department has issued nearly 700,000 passport cards to U.S. citizens in advance of tougher border crossing rules that take effect June 1. Washington State has issued more than 10,000 EDLs, primarily to frequent visitors to nearby Vancouver, British Columbia.

The Passport Cards and EDLs that were the subject of this scanning demonstration use long range, insecure, EPC Gen 2 RFID tags, which lack encryption and authentication. It is not surprising this researcher could remotely read Passport Cards, because the RFID tag technology used in them was actually designed for tracking objects at long distances and is used mostly in manufacturing and shipping. These RFID tags have minimal built-in support for security and privacy and, for that reason, the State Department issues Passport Cards with protective sleeves to prevent them from being read when not in use.

In sharp contrast, the blue U.S. electronic passport books use RF-enabled contactless smart card technology. This is a completely different technology that includes a small computer inside the e-passport book. The U.S. e-passport is not vulnerable to the remote reading attack demonstrated on RFID-based Passport Cards and EDLs. A small gold chip icon on the book cover indicates an electronic passport.

U.S. electronic passports are very privacy-secure. A metallic shield in the cover prevents any information from being read when the book is closed. Further, it has a short read range of two inches and the chip won’t give up any information until the passport book is physically opened and a unique key that is printed inside the passport is optically scanned and sent to the chip. The U.S. Department of State calls this e-passport security Basic Access Control.

Contactless smart cards are designed for high security applications and are used in tens of millions of identity credentials and payment cards worldwide.

Featured

  • New Report Reveals Top Trends Transforming Access Controller Technology

    Mercury Security, a provider in access control hardware and open platform solutions, has published its Trends in Access Controllers Report, based on a survey of over 450 security professionals across North America and Europe. The findings highlight the controller’s vital role in a physical access control system (PACS), where the device not only enforces access policies but also connects with readers to verify user credentials—ranging from ID badges to biometrics and mobile identities. With 72% of respondents identifying the controller as a critical or important factor in PACS design, the report underscores how the choice of controller platform has become a strategic decision for today’s security leaders. Read Now

  • Overwhelming Majority of CISOs Anticipate Surge in Cyber Attacks Over the Next Three Years

    An overwhelming 98% of chief information security officers (CISOs) expect a surge in cyber attacks over the next three years as organizations face an increasingly complex and artificial intelligence (AI)-driven digital threat landscape. This is according to new research conducted among 300 CISOs, chief information officers (CIOs), and senior IT professionals by CSC1, the leading provider of enterprise-class domain and domain name system (DNS) security. Read Now

  • ASIS International Introduces New ANSI-Approved Investigations Standard

    • Guard Services
  • Cloud Security Alliance Brings AI-Assisted Auditing to Cloud Computing

    The Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment, today introduced an innovative addition to its suite of Security, Trust, Assurance and Risk (STAR) Registry assessments with the launch of Valid-AI-ted, an AI-powered, automated validation system. The new tool provides an automated quality check of assurance information of STAR Level 1 self-assessments using state-of-the-art LLM technology. Read Now

  • Report: Nearly 1 in 5 Healthcare Leaders Say Cyberattacks Have Impacted Patient Care

    Omega Systems, a provider of managed IT and security services, today released new research that reveals the growing impact of cybersecurity challenges on leading healthcare organizations and patient safety. According to the 2025 Healthcare IT Landscape Report, 19% of healthcare leaders say a cyberattack has already disrupted patient care, and more than half (52%) believe a fatal cyber-related incident is inevitable within the next five years. Read Now

New Products

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis.

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.