S. 3427, a bill introduced in the Senate this week by Senators Charles E. Schumer (D-NY) and John Cornyn (R-TX),  would require would require ID “verification” as a prerequite to buying a prepaid cell phone or SIM card.

The seller or reseller of the phone or SIM card would be required to collect your personal information (including name, address, date of birth, and for online sales your Social Security number) and all unique identifiers of the phone or SIM card including the including the EMEI or other serial number and the assigned phone number.

For in-person sales, you would have to show government-issued ID credentials in a form to be determined later by the Attorney General.  For online or other non-face-to-face sales, you would also have to provide “Any other personal identifying information that the Attorney General finds, by regulation, to be necessary for purposes of this section.”

The bill would place no limits on the amount or intrusiveness of the information the Attorney General could demand, as long as it is spelled out in regulations.  And there’s nothing in the bill to stop the AG from making the verification requirements so onerous as to amount to a de facto ban on online or mail order sales of prepaid SIM card or cell phones, as Ken Grunski —  president of Telestial.com, a leading US-based online source of prepaid SIM cards and cell phones for international travelers — immediately picked up on when we sent him a copy of the bill:

The level of verification that the bill requires is critical to e-commerce providers … because they can only verify an identity to a certain extent online. For example, if the bill just required that the billing address match the shipping address, we can do that easily. But if the bill requires a state or country issued identity card, we can’t do that online. You are essentially saying that the product can’t be sold online anymore, because you can’t verify the identity of the person making the purchase.

It really opens up all types of questions, like what types of impositions would that take on the e-commerce companies and why only SIM cards and prepaid cell phones? This could lead to regulation of all types of telecom products – or anything that puts out a transmission signal.

Read More →

It’s tempting to think that when you show a business or government agency your identity credentials, all that happens is an ID “check”.  They verify that your ID is genuine, and that it shows that you are in a category of people who are authorized to cross a border, buy alcohol, operate a motor vehicle, or whatever.  And then you’re on your way.

What’s wrong with this?  Demands for ID are wrong, but what’s also wrong with this picture is that, increasingly often, this isn’t all that’s happening.

A new product announcement shows how much more than “verification” is sometimes going on behind the scenes.  A press release from Uveritech announces their new North American franchise to distribute a document authenticator made by L-1 Identity Solutions, the prime contractor for producing US drivers licenses as well as many countries’ passports.

L-1’s website describes the desktop device as, “A combined hardware and software product that automatically authenticates a wide range of documents, including passports, visas, immigration cards, driver’s licenses and military ID cards.”  But the product description shows that it performs much more than mere “authentication”, including scanning, optical character recognition (conversion of the image of the document to text), and reading of RFID chips in passports, enhanced drivers’ licenses, and other documents, as well as:

• “Automatically Cross Reference Smartchip data in the MRZ [Machine Readable Zone].
• “Collect and organize data and images from document transactions through the configurable options in the embedded relational database….
• “Print and/or send … executable files with the images….
• “Seamlessly integrate with any existing government or commercial network infrastructure, (i.e. Australian Customs, ABN AMRO, Brazilian Border Police.)”

So what’s being advertised under the rubric of “authentication” is actually automated capture of information about you (not just the visible data but also the machine-readable data in the magnetic stripe, lines of OCR type, and/or RFID chip, using L-1’s expertise in document and data formats derived from its role as government contractor ), conversion of this information about you to standardized digital format, loading of this data into an embedded relational databases, and “seamless[] integrat[ion]” of that database “with any existing government or commercial network infrastructure”.

Still feeling sanguine that it’s “just a quick check” of your ID, after which you can be on your way without further concern for future repercussions as long as you’ve been allowed to pass?

Read More →