A proposed new RFID-enabled passport card intended for use by Americans frequently travelling to Canada, Mexico. Bermuda and the Caribbean poses serious security and privacy risks for users, the Centers for Democracy and Technology (CDT) warned this week.

Among the concerns are the potential for the card to be used for location tracking by government and private entities and the relative ease with which it can be manipulated for identity theft purposes, the CDT said.

The Washington-based think tank's warning was prompted by a final ruling in the Federal Register from the U.S. Department of State on Dec. 31, 2007 calling for the use of so-called "vicinity read" radio frequency identification technology on proposed new passport cards. The department first announced plans to use RFID chips for new passport cards back in October 2006 and has been going through a process of collecting and responding to comments on its plans.

The identification cards would be needed by residents who don't have passports for verifying their identity at land, air and sea border crossings and are to be issued as part of the Departments of State and Homeland Security's Western Hemisphere Travel Initiative, or WHTI. The credit-card sized passport cards will use vicinity-read RFID technology that allow them to be read from at least 20 to 30 feet away by customs and border-protection officials. The goal is to substantially reduce wait times at the border by allowing officials to access and queue up a border crosser's information even before they reach the official.

The approach is substantially different from the proximity-read technology being used in U.S. electronic passports, and it offers fewer protections, according to Ari Schwartz, deputy director at the CDT. Electronic passports contain all of the same identification data that appears on the first page of a passport, and includes a digital photograph and a digital signature. But the information on those chips is encrypted at all times and can only be accessed by physically swiping the card through a reader at the border crossing.

In contrast, said Schwartz, the proposed RFID-enabled passport cards can be read from a distance, and without user notice, consent or control over when the information is collected. Additionally, information from the card is transmitted in the clear -- that is, without encryption. The RFID technology itself is also more susceptible to electronic eavesdropping and hacking, which makes the cards less tamper resistant compared to electronic passports, he said.

For more enterprise computing news, visit Computerworld. Story copyright Computerworld, Inc.