Privacy Digest

RFID Anti-Skimming Laws Approved - Via Threat Level:

California followed Washington State's footsteps this week to become the second U.S. state outlawing so-called Radio Frequency Identification Device skimming.

Skimmers can easily pilfer information from non-encrypted RFID tags that are growing commonplace. California's bill was adopted and signed by Gov. Arnold Schwarzenegger this week after a demonstration showed that personal information skimmed from entry-card badges from statehouse workers allowed hackers access to secured areas of government offices.

The legislation came a year after the hacking of the  RFID-enabled Dutch passport, and the successful hacks of the Exxon Mobile key fob and the exposed VeriChip human RFID implant

Still, California's measure (.pdf) and the one Washington State adopted in March, don't mandate any RFID encryption. So the vulnerabilities of the Golden State statehouse's entry system remains.

(Read Original Article - Via Threat Level.)

No Funding for a National “REAL ID” Database? - Via CDT - PolicyBeta:

Congress couldn’t get its act together in time to pass a proper appropriations bill for the 2009 fiscal year. Instead, last weekend it passed a continuing resolution (CR) to fund the federal government – for homeland security purposes at least – until March.

Perhaps not surprisingly, there was an allocation of $100 million to fund REAL ID, the federal effort that puts us closer to a national ID card by standardizing driver’s licenses. CDT hopes Congress will repeal the exceedingly bad law, especially in light of the 21 states that have come out against REAL ID.

But what was surprising in the CR was the limitation placed on spending for REAL ID. The Act provides that individuals can only be licensed in one state at a time, thus states are required to share information with every other state to ensure that a driver’s license (or state ID card) applicant doesn’t already have a REAL ID card from somewhere else. Referencing this requirement, Section 547 of the CR states that [emphasis added]:  read more »

Repeal REAL ID Petition Drive Gears Up for Fourth of July - Via ACLU - Privacy:

PORTLAND - Leaders of the drive to Repeal REAL ID announced Wednesday they will be "Defending the Fourth on the Fourth," by mobilizing hundreds of volunteers for a final push for signatures to repeal the state's REAL ID law, which violates the privacy rights guaranteed under the Fourth Amendment of the Constitution.

"Defending the Fourth on the Fourth" will kick off at a Press Conference Wednesday morning at 11 a.m. on the steps of City Hall on Congress Street in Portland.

"With Independence Day coming, we'd like to assert our independence by repealing REAL ID," said Kathleen McGee who brought the People's Veto effort. "There's nothing more patriotic than upholding the Constitution and the Bill of Rights."  read more »

McCain Campaign: Telecom Amnesty Requires Hearings and Apologies for Spying - Via Threat Level:

NEW HAVEN, Connecticut -- As president, presumptive Republican nominee John McCain would not support immunity for the telecoms that aided the Bush administration's warrantless spying program, unless there were revealing Congressional hearings and heartfelt repentance from those telephone and internet companies, a campaign surrogate said Wednesday.

The remarks from Chuck Fish, a full-time lawyer for the McCain campaign and a former Time Warner vice president *, represent a big change on the issue for McCain, who voted in February to keep immunity in the Senate spying bill. Fish was careful to say, however, that he was answering a double-hypothetical question -– if McCain wins, and if the issue is still alive in 2009.  read more »

Minnesota Passes Veto-Proof Anti-Real ID Bill - Via ACLU Blog - Privacy & Technology:

Last night, Minnesota joined 18 other states in rejecting Real ID, the Department of Homeland Security's attempt at a national ID card. More states are jumping on the anti-Real ID bandwagon. Noam Biale, Advocacy Coordinator for our Technology and Liberty Project, writes in DailyKos :  read more »

DHS Can’t Admit Its Own Mistakes - Via CDT - PolicyBeta:

Back in April, I blogged about how Department of Homeland Security Secretary Michael Chertoff was “dead wrong” when he testified before the Senate that personal information can’t be “skimmed” from an unencrypted barcode, which all driver’s licenses will have under the REAL ID program. Chertoff completely denied that there are any privacy risks associated with the REAL ID card’s “machine-readable zone.”

Sen. Feingold, D-WI, was right to question Chertoff’s testimony that day and followed up with a letter asking the Secretary to further explain why he thought citizens’ personal information wasn’t at risk or why they couldn’t be tracked by scanning REAL ID cards during a multitude of transactions. Just this week, DHS responded to Sen. Feingold via letter. The Department again shirked responsibility for ensuring that Americans’ personal information stored on REAL ID cards is protected and not accessible by unauthorized parties – businesses and government agencies alike.  read more »

Daily Kos: Another victory for the anti-Real ID rebels - Via ACLU's diary in Daily Kos:

By Larry Frankel, State Legislative Counsel, ACLU Washington Legislative Office

The anti-Real ID movement just took a big step forward, with the Arizona Senate’s 21-7 vote to bar implementation of Real ID in Arizona. The bill (H.B. 2677) still has to go back to the Arizona House for another vote and then on to Governor Janet Napolitano for her signature. But as of this writing, Arizona is poised to join the growing number of states who have recognized that Real ID is an expensive and unworkable invasion of our privacy.

The good work of a bipartisan group of Arizona legislators contrasts with what happened last week in Minnesota. Governor Tim Pawlenty vetoed a transportation bill that passed the Minnesota legislature with overwhelming bipartisan support because the members of the Minnesota legislature had the audacity to say no to the federal Real ID Act. The governor’s veto message reads like a set of talking points from the Department of Homeland Security.  read more »

ACLU Testifies before Senate against Real ID - Via ACLU - Privacy:

WASHINGTON – Caroline Fredrickson, director of the ACLU Washington Legislative Office testified today about the privacy and security concerns with creating a federal identity document every American will need in order to fly on commercial airlines, enter government buildings, or open a bank account. The Senate Committee on Homeland Security and Government Affairs Subcommittee on Oversight of Government Management, the Federal Workforce, and the District of Columbia held an oversight hearing on the Real ID Act and the Western Hemisphere Travel Initiative, examining the federal government’s capacity to implement the new identification systems.  read more »

Chertoff Disagrees with the Rest of His Agency, Again - Via CDT - PolicyBeta:

Nine days ago, Sophia Cope blogged about how Homeland Secretary Secretary Michael Chertoff suggested that REAL IDs cannot be skimmed, in sharp contrast to DHS REAL ID Regs, which clearly say that the REAL ID is at risk of skimming. Today, CDT Fellow Peter Swire blogged on the Center for American Progress Web site about a new Chertoff statement where he said that “fingerprints aren’t ‘Personal Data.’” Swire shows that this comment lies in sharp contrast to DHS’ stated policy that fingerprints are “personally identifiable information.”

It is now time for DHS to make clear, is Chertoff purposely suggesting changes to existing policy or are these both misstatements?

(Read Original Article - Via CDT - PolicyBeta.)

'Outrageous' REAL ID affront to Americans' privacy concerns ( by Mark Sanford, the Republican governor of South Carolina ) - Via The Post and Courier of Charleston, SC :

If I were a betting man, I'd wager that most people haven't followed the debate on REAL ID. If you indeed missed it, I would ask that you take the time to learn about what I consider the most troubling piece of legislation I've seen come from Washington since I've been governor.

REAL ID would surreptitiously require all fifty states to change their driver's licenses to act as de-facto national ID cards. It's outrageous, and not just because it was a back door way of doing something proponents in Washington have never been able to pull off in the past.

I say "outrageous" because REAL ID was never really debated in Congress because the cost of its implementation is handed down to states and individuals, and because it is an affront to Americans' privacy concerns.

Let's look more closely at a few of those concerns:  read more »

E-Passport Hacker Designs RFID Security Tool - Via Threat Level:

Editor: Interesting graphic removed. Go to original site for that [...]

The team that produced the RFDump research/hacker tool for cloning and altering data stored on radio-frequency ID tags has now come out with a product to thwart RFID hackers.

German security researcher Lukas Grunwald, who made headlines two years ago for uncovering security vulnerabilities in new electronic passports being adopted by the U.S. and other countries, created RFDump with colleague Boris Wolf in 2004.

Now the two have created RF-Wall (shown on the lower shelf in the picture at right) to help thwart RFID fraud and attacks against e-passports, electronic access cards and payment cards -- such as the Mifare Classic card that is used in the London Underground and which security researchers recently cracked.  read more »

Idaho Joins the Ranks of the Anti-Real ID States - Via ACLU - Privacy:

WASHINGTON – This week, Idaho Governor Butch Otter signed into law legislation that prohibits the Idaho Department of Transportation from complying with the Real ID Act of 2005, a federal law requiring the states to implement a national identification card. The bill landed on the governor’s desk after receiving overwhelming bipartisan support in both the Idaho House and Senate, not receiving a single vote against passage. Idaho now joins Georgia, Maine, Montana, New Hampshire, Oklahoma, South Carolina, and Washington as states that have passed laws prohibiting compliance with Real ID.

"Governor Otter heeded the will of the people this week when he rejected the invasive and problematic Real ID Act," said Barry Steinhardt, director of the ACLU Technology and Liberty Program. "Idaho overwhelmingly rejected the Department of Homeland Security’s national ID program, with not a single legislator voting to support Real ID.  read more »

Chertoff’s Defense of REAL ID is “Dead Wrong” - Via CDT - PolicyBeta:

Department of Homeland Security Secretary Michael Chertoff has a hard job. Among other things, it’s his responsibility to make sure that our country isn’t attacked by terrorists and that undocumented immigrants don’t cross our borders. So it’s understandable when he vociferously defends his Department’s efforts at “protecting the homeland.” But it’s inexcusable when the guy is simply factually (and vociferously) wrong on an important policy issue.

On April 2, Chertoff, testifying before the Senate Judiciary Committee during a hearing on DHS oversight, had the gall to say that public interests groups have been putting out “misinformation” and are “dead wrong” about the privacy and civil liberties risks of REAL ID. Yet it was the Secretary who put out misinformation and was dead wrong about the risk of the wrong people gaining access to personal information stored in the REAL ID card’s “machine-readable zone” (MRZ).  read more »

CDT Corrects the Record About Security of Personal Data on REAL ID Cards - Via Center for Democracy and Technology:

Today CDT sent a letter to the Senate Judiciary Committee highlighting Department of Homeland Security Michael Chertoff’s recent testimony in which he wrongly asserted that the personal information stored on REAL ID cards will be safe from unauthorized access, and accused privacy advocates of spreading “misinformation.” In fact, the REAL ID Act and regulations mandate that Americans’ personal data be stored in an unsecured barcode, which can be easily scanned with widely available readers.

# CDT REAL ID Letter to Senate Judiciary Committee [PDF] April 08, 2008

(Read Original Article - Via Center for Democracy and Technology.)

Real ID Won’t Really Be Enforced, DHS Gives Maine Real ID Extension - Via ACLU - Privacy:

WASHINGTON DC – Earlier today, in response to the Department of Homeland Security denying Maine an extension to comply with the federal Real ID law, Governor John Baldacci agreed to propose changes in state law that currently allows undocumented people to obtain drivers’ licenses. Whether those changes are actually enacted into law is now in the hands of the Maine legislature, which last year overwhelmingly rejected Maine’s participation in the program.  read more »

DHS Issues Maine Ultimatum on Real ID - Via Threat Level:

Editor: Interesting graphic removed. Go to original site for that [...]

Maine has until Wednesday to agree to driver's licenses changes demanded by the federal government or face the consequences of having Maine driver's licenses rejected as valid identification at the nation's airports come May 11.

DHS all but told the state Monday that it was the country's "weakest link" and that the state needed to change its licensing ways or face the fed's wrath.

Maine is now the lone state not to have been given an extension to long-delayed Real ID regulations, after three fellow protesting states -- Montana, New Hampshire and South Carolina -- got their extensions in the last two weeks despite not pledging allegiance to Real ID.

In January, Maine became the first state to vote not to comply with the federal government's Real ID rules, which aim to create a de facto national identification card by imposing federal standards, linking state driver's license databases and limiting services available to persons who do not have such an ID card.  read more »