The drive-thru passport

A new breed of RFID-based passport cards might be getting through border crossings a bit easier - for a price. Starting this Friday, the Department of State will begin accepting applications for passport cards, an alternative to the traditional paper-based passport booklet, that includes a radio frequency ID chip that can be scanned at airports and border crossings.

The cards will only be usable on land- and sea-based checkpoints, so you'll still need a traditional passport. They could, however, speed up those trips to Montreal or Tijuana.

But the technology behind the cards has privacy advocates outraged - and for good reason. While the RFID-based credit and debit cards trickling out from Visa and Mastercard must be held within a few inches of a reader, the government's new passpord cards can be read by scanning devices located up to 20 feet away. Critics say that information on the cards isn't adequately protected, since hackers, businesses or other organizations outside of government could skim data from the cards. Indeed, even bank cards that encrypt RFID data have vulnerabilities, and these cards won't offer anywhere near that level of protection.

The State Department counters that the chip will contain no personally identifying information: Only a unique identifier that maps back to information about you in back-end government databases. But that's enough to cause trouble.

By the very act of creating a unique identifier for every individual, the Department of State is in effect creating personally identifiable information that would be very useful to others outside of government.

Architecturally, the passport card is similar in some ways to the dual-use magnetic stripe card used by some resorts as a combination room key and hospitality card that opens your door and allows you to charge purchases at the resort. To enable this the system creates a unqiue identifier for your card. That maps to a back-end point of sale database containing your personal information. But while that card - and the number on it - are terminated at the end of your stay, the passpord card number persists forever. It becomes another permanent identifier that uniquely identifies you. It is a whole new incarnation of the digital you, used to prove that you are who you say you are.

And that digital identity is ready for the taking, so long as the subject walks within 20 feet of a reader.

It is true that the identifier by itself isn't useful. But if data were skimmed from the card in certain contexts, it's possible that the data on the passport card could be matched up with other information about you. For example, if it was scanned while you were applying for a payday loan or credit card.

Don't think that would happen? Pehaps not. But consider this: The last identification card issued by the federal government to every American also had an easily readable identifier on it. It was called the Social Security card.

The passport card holder's one defense against unauthorized reading is a protective sleeve that prevents the number from being read surrepticiously. Or you can wait for the e-passport. That also contains an RFID chip, but a reader must be within three inches of the card to download data from it.

Better yet, you can do what I did. My new passport just arrived last week. It's good old fashioned paper.