About the new UK RFID passports:

Fatally, however, the ICAO suggested that the key needed to access the data on the chips should be comprised of, in the following order, the passport number, the holder’s date of birth and the passport expiry date, all of which are contained on the printed page of the passport on a “machine readable zone.”

Cracked it! Steve Boggan, The Guardian, Friday November 17, 2006

The UK Home Office says not to worry.

Ross Anderson spells out how if you can read it, you can clone it, plus:

“There isn’t even a defence against the brute-force attack. In much the same way as you are only allowed three attempts to feed in your PIN number at an ATM, the passport chip could have been made to stop allowing repeated incorrect attempts to contact it. As things stand, a computer can keep trying until it gets the numbers right. To say this doesn’t matter displays a cavalier lack of concern.”

I’d worry.

Bruce Sterling sums up the situation:

(((If we simply returned to the security situation status quo ante on 9/10 instead of 9/11, it would be like the civilized world suddenly got over a massive, self-inflicted stupidity virus. Furthermore, we’d be a lot safer.)))

Arphid Watch: Find Own Foot, Aim Hastily, Pull Trigger, Bruce Sterling, Beyond the Beyond, Friday, 17 November 2006

Not stopping there, Bruce spells out what’s really going on here:

(((They did this, not because they want to make private citizens more secure against ID theft, but because they want to install huge databases that track the movements of civil populations generally. The point of electronic ID is to input a suspect passport number and see every place that guy’s been in the last 20 years. Then you compare that the movements of other known malefactors and you’ve got an instant Al Qaeda winnowing-machine.)))

(((Of course some individuals will suffer, but compared to the awesome imaginary benefits of Total Information Awareness, that’s like watching a few Nevada civilians cough up their lungs from atom-bomb tests.)))

He’s speculating, but this is a case where the degree of criminal stupidity required to issue a passport like this is not as credible as Bruce’s speculation.

-jsq