RFIDs, Facial Recognition and other problems with

1
RFIDs, Facial Recognition and other problems with
Enhanced Drivers Licences
ltlt
National Public Forum on Enhanced Drivers
Licences, privacy and state surveillance under
the new Canada-U.S. border regime Ottawa - March
24, 2009
Andrew Clement, Krista Boa, Joseph Ferenbok,
Brenda McPhail Karen Smith
Identity, Privacy and Security Initiative
Information Policy Research Program Faculty of
Information, University of Toronto
2
Overview

• What is an EDL?
• RFID capabilities
• Border crossing waits
• Facial recognition screening
• EDL versus Passport
• Summary - get a passport!

3
1
4
1
5
Demo of RFID reader

• RFID reader display

Show read range
6
RFID Properties (EPC Gen 2)

• RFID EDL numbers are unique personal identifiers
  readable at a range of up to 10m
• RFID unique numbers are an access key to database
  records that contain personal information
• RFID unique numbers are personal information
• This equipment can also
• duplicate EDL tags
• turn tag on and off
• kill tag to prevent further reading
• EPC Gen 2 is insecure and privacy invasive in EDLs

cloning
self-protection or denial of service?
7
What Border Patrol will see

• From Canadian (CBSA) database
• RFID unique number gt
• Full name (first name, last name)
• Birth date Gender Citizenship
• License issuing jurisdiction
• Issuing country EDL expiration date
• OCR/MRZ unique identifier
• Digital image (Applicant photo)
• License status and status changes

• From US (CBP/DHS/NCIC,
• ICEPIC) databases
• Travel history?
• Threat level?
• Police record?
• ???

8
Vehicle Inspection Time Reduction?

• Will having an EDL rather than a passport save
  you time at the border?
• Using an EDL saves 5-10 secs over using a
  passport (which has a Machine Readable Zone
  (MRZ))
• Also note
• No additional lanes at border crossings
• No special lanes for EDLs

No!
9
Wait Time Reduction?
75 MRZ/25 RFID i.e. barely any reduction in
wait time
1
10
FRT - Facial Recognition Tech(aka Photo
Comparison Technology)
Image template
Ontario DL(ID) database 10M records
11
FRT - Facial Recognition Tech(aka Photo
Comparison Technology)

• Mandatory for all drivers licences in some
  provinces (Alberta, Ont., B.C.)
• Evidence for effectiveness?
• Protection against false positives? Redress?
• Security of the database?
• Data sharing? Strictly limited and transparent?
• Protection against function creep?
• See video at IDforum.ca

12
EDL vs Passport
EDL Passport
Cost 50 gt 87
Ease to obtain ltgt
Ease to use gt
Wait time
Usefulness lt
Privacy lt
Security lt
Sovereignty lt
?
?
?
?
?
?
?
?
?
13
Summary - Get a passport!
Stop! Think again
Still preferable
Stop! Think again
Four-part test
Necessary
Effective
Proportionate
Minimal
RFID
FRT
Passport
?
?
?
?
?
?
?
?
?
?
?
?
14
Check out the FAQ, webcast, videos and on-line
discussion at IDforum.ca
IPRP
Information Policy Research Program
15
References
1 CTST 2008 Passcard and Enhanced Drivers
License Panel Discussion, Track A14 Federal
Government ID Use Cases, Paul Hunter May 13, 2008