The state of New York has begun issuing (pdf) so-called “enhanced” driver’s licenses (or EDLs). These licenses contain RFID tags and include the individual’s citizenship status on the face of the cards. They are issued under the Department of Homeland Security’s “Western Hemisphere Travel Initiative” and will be used as alternatives to passports for crossing the US border.

According to DHS, the “long-range” RFID tag would include a unique number that Customs and Border Protection would “read” as you drove up to the checkpoint and use that unique number to link to your individual name and file. (Such long-range tags can be read from a distance of 70 feet or more.) There are numerous privacy and civil liberty problems connected with using RFID tags in identification documents. Some EDL critics would surprise you: the RFID industry, the Government Accountability Office, and the DHS’s own Data Privacy and Integrity Advisory Committee.

The DHS Data Privacy and Integrity Advisory Committee urged (pdf) that long-range RFID only be used in ID documents if RFID is the “least intrusive means,” because there are significant privacy and security drawbacks.

The Government Accountability Office also has urged (pdf) against the use of RFID to track people, testifying that:

Once a particular individual is identified through an RFID tag, personally identifiable information can be retrieved from any number of sources and then aggregated to develop a profile of the individual.

From the RFID industry group Smart Card Alliance (pdf): “Even as manufacturers of RFID, the Alliance attests to the fact that long-range RFID, the most likely technology to be selected by DHS, is an inappropriate technology for human identity documents.”

The Smart Card Alliance went on to detail significant problems with the use of long-range RFID in ID cards:

• The lack of strong cryptographic features in long-range RFID-based cards, making it easy for criminals to read the unprotected, static citizen identifiers from the cards and create fraudulent documents.
• The reliance on real-time access to central databases and networks in order to verify every individual’s identity, leading to vulnerabilities to infrastructure failures and attacks or to network and system security breaches.
• The challenges of reliably reading large numbers of long-range RFID tags at crowded border crossing points, making it unlikely that desired operational efficiencies will be achieved.
• The ability for criminals to use inexpensive long-range RFID readers to detect the citizen’s electronic identity from a distance, putting U.S. citizens carrying the enhanced driver’s license at risk of having their movements tracked.

These EDLs are a bad idea in terms of security and liberty. States should reject them, instead of submitting to DHS’s plans.

New York is not the only state supporting EDLs. According to DHS, “In August, Vermont and Arizona committed to producing EDLs […] DHS is in discussions with several other border States to develop EDL projects, including Michigan, Texas, and California.”

For background on the Western Hemisphere Travel Initiative, you can read The Identity Project‘s detailed comments (pdf) explaining the program’s significant problems.