PASS card won't jeopardize privacy: NIST

The government's planned border-crossing identification card does not require strong privacy protections because the only data it can transmit wirelessly is a reference number, according to the director of the National Institute of Standards and Technology.

The reference number will be etched on the Generation 2 Radio Frequency Identification tag on the People Access Security Services (PASS) card, to be issued by the State and Homeland Security departments.

The reference number can be communicated wirelessly to readers 20 feet away or more. It will be read at border crossings to serve as a "pointer" to a file in a Homeland Security database that will contain the personal identifying information of the person to whom the card was issued.

But the reference number itself is not personal information, according to NIST Director William Jeffrey. Thus, the PASS card architecture does not require compliance with international standards for protecting personal information on an identification card, such as encryption.

"Strong encryption was deemed unnecessary due to the lack of information on the Radio Frequency chip outside of the pointer to the secure Department of Homeland Security database," Jeffrey wrote in a May 24 letter to the Smart Card Alliance, an industry group.

NIST also concluded that since the RFID chip contains no personal information, the card architecture for the PASS card is not subject to international standards regarding protection of personal information on smart cards and other types of identification cards.

"The card architecture will contain no technology to collect, store and share personal information," Jeffrey wrote.

Jeffrey's letter is the latest development in a dispute with industry over NIST's recent certification of the PASS card architecture under a request from Congress.

The industry group, the Smart Card Alliance, has accused NIST of certifying the so-called Gen2 RFID card architecture without using "the appropriate standards and best practices relevant to human identity applications," Alliance Executive Director Randy Vanderhoof wrote in a May 17 letter to Jeffrey. The alliance is a trade association representing companies that make identification cards and related systems.

In addition, the industry group accused NIST of failing to properly evaluate whether the Gen2 RFID is appropriate technology for a personal identification card. The Gen2 RFID chip was designed for tracking merchandise in warehouses and on shipping pallets.

In response, Jeffrey said NIST's review was thorough and in compliance with the request from Congress. He said NIST was asked to review Gen2 RFID technology for the card because that technology was selected in advance by the State and Homeland Security Departments. Given that choice, NIST's role was to recommend changes to the technology to ensure compliance with international standards, Jeffrey wrote.

NIST completed its task, and a request for proposals for a contract to produce the cards is expected soon. One of the anticipated changes reviewed by NIST is usage of an attenuation sleeve to block the radio signals from being transmitted wirelessly by the RFID tag when the card is not being displayed.

The PASS card is part of the Western Hemisphere Travel Initiative and is intended for use by Americans, Mexicans and Canadians who frequently cross the border. Its design has been controversial because the Gen2 RFID tags have raised privacy worries about unauthorized reading and tracking of card holders. DHS officials have asserted that the long-distance RFID tags will enable them to quickly process traffic at the borders.