California's Assembly is considering a bill called the Identity Information Protection Act (SB 682) that would limit the use of radio-frequency identification (RFID) tags in state-issued identification. The bill is very sensible: it doesn't reject RFIDs in ID, but it does require that they be limited to transmitting encrypted identifiers, that they be under the user's control, and that the owner of the ID be informed about the risks of RFID-enabled identification (there's a good explanation of this on the ACLU's factsheet).
Numerous California civil liberties organizations have formed up behind the bill, including EFF and the ACLU, and the bill passed the senate with flying colors. But now a bunch of industry types who hoped to sell their RFID technology to the state are lobbying hard in the Assembly to kill the bill. We're looking for California residents to send letters to their state reps expressing support for the bill as well.
The alternative is pretty Orwellian: imagine a state full of ID cards that can be read without your knowledge or permission, containing arbitrary facts about your identity and personal life. I like knowing that my ID stays in my wallet unless I take it out — don't you?
Would the government want to know where you are at all times? Would an identity thief or a kidnapper be interested in the personal information contained in your driver's license or your child's school identity card? Unfortunately, the same technology used by businesses to track inventory could be used by the government to track people in California.
"Tag and Track" devices known as RFID's (Radio Frequency Identification tags) are being considered for use in government documentation like drivers' licenses, K-12 student ID cards, medical cards, benefit cards, and library cards.
Fortunately, The Identity Information Protection Act (SB 682), authored by Senator Joe Simitian (D-Palo Alto), would prohibit the inclusion of RFID tags in these mass distributed identification cards. It will also ensure that any other state-issued cards that contain RFID tags use strong encryption and authentication, and broadcast very little personal information.
(Thanks, Nicole!)
