November 21, 2006 | By Hugh D'Andrade

British RFID Passports Easily Hacked

New passports issued in the UK contain Radio Frequency Identification (RFID) chips, supposedly for purposes of increased security. But a report in the British newspaper The Guardian found the passports surprisingly easy to read and copy. Using a device purchased for £250, a Guardian reporter was able to view and copy information from several of the new passports.

Although the new passports use a strong crypto algorithm to protect their biometric data, the encryption key is easy to steal. As the ICAO's website reveals, the key consists of the passport number, the holder's date of birth, and the expiration date.

Obtain those details — or even brute force them (the University of Cambridge's Ross Anderson says the RFID's do not lock themselves after even high numbers of repeated attempts) — and you can read out enough data to create a cloned passport.

Phil Booth, from the organization NO2ID, took part in the newspaper's investigation. "This is simply not supposed to happen," says Booth. "This could provide a bonanza for counterfeiters because drawing the information from the chip, complete with the digital signature it contains, could result in a passport being passed off as the real article. You could make a perfect clone of the passport."

Since a reader can potentially scan a passport from as much as 30cm away, a passport could be read and cloned without the passport ever leaving the victim's pocket.

Click here for more information on EFF's work to prevent RFID tags in ID cards and elsewhere.


Deeplinks Topics

Stay in Touch

NSA Spying

EFF is leading the fight against the NSA's illegal mass surveillance program. Learn more about what the program is, how it works, and what you can do.

Follow EFF

Mayweather or Pacquiao? Regardless of who wins, Internet intermediaries are the losers: https://eff.org/r.qbeb

May 1 @ 5:09pm

How private DNA data led Idaho cops on a wild goose chase and linked an innocent man to a 20-year-old murder case https://eff.org/r.3832

May 1 @ 3:08pm

We think that YouTube should celebrate its 10-year anniversary by fixing ContentID eff.org/r.lc85

May 1 @ 11:08am
JavaScript license information