<<

National Public Forum on “Enhanced” Drivers Licences,privacy and state surveillance under the new Canada-U.S. border regime

Ottawa - March 24, 2009

Identity, Privacy and Security Initiative & Information Policy Research ProgramFaculty of Information, University of Toronto

Andrew Clement, Krista Boa, Joseph Ferenbok, Brenda McPhail & Karen Smith

RFIDs, Facial Recognition and other problems with “Enhanced” Drivers Licences

Overview

What is an EDL? RFID capabilities Border crossing waits Facial recognition screening EDL versus Passport Summary - get a passport!

[1]

[1]

Demo of RFID reader

RFID reader display

Show read range

RFID Properties (EPC Gen 2)

RFID EDL numbers are unique personal identifiers readable at a range of up to 10m

RFID unique numbers are an access key to database records that contain personal information

RFID unique numbers are personal information

This equipment can also:– duplicate EDL tags– turn tag on and off – ‘kill’ tag to prevent further reading

EPC Gen 2 is insecure and privacy invasive in EDLs

cloning

self-protection or denial of service?

What Border Patrol will see:From Canadian (CBSA) database:RFID unique number > Full name (first name, last name) Birth date * Gender * Citizenship License issuing jurisdiction Issuing country * EDL expiration date OCR/MRZ unique identifier Digital image (Applicant photo) License status and status changes

From US (CBP/DHS/NCIC,

ICEPIC…) databases: Travel history? Threat level? Police record? ???

Vehicle Inspection Time Reduction?

Will having an EDL rather than a passport save you time at the border?

Using an EDL saves 5-10 secs over using a passport (which has a Machine Readable Zone (MRZ))

Also note: No additional lanes at border crossings No special lanes for EDLs

No!

Wait Time Reduction?

75% MRZ/25% RFID

i.e. barely any reduction in wait

time

[1]

FRT - Facial Recognition Tech(aka Photo Comparison Technology)

Ontario DL(+ID) database~10M records

Image template

FRT - Facial Recognition Tech(aka Photo Comparison Technology)

Mandatory for all drivers licences in some provinces (Alberta, Ont., B.C.)

Evidence for effectiveness? Protection against false positives? Redress? Security of the database? Data sharing? Strictly limited and transparent? Protection against function creep?

See video at IDforum.ca

EDL Passport

Cost ~$50 > $87

Ease to obtain <>Ease to use >Wait time =Usefulness <Privacy <Security <Sovereignty <

EDL vs Passport

Summary - Get a passport!

Four-part test

Necessary

Effective

Proportionate

Minimal

FRT RFID

?

Passport

Stop!Think again

Still preferabl

e

Stop!Think again

Check out the FAQ, webcast, videos and on-line discussion at:

IDforum.ca

[IPRP]Information Policy Research Program

References[1] CTST 2008 Passcard and Enhanced Driver’s

License Panel Discussion, Track A14 Federal Government ID Use Cases, Paul Hunter May 13, 2008