The Red Brick Times

US passports include ID chips hidden inside the cover. The chip includes a "biometric" identifier that the US Electronic Passport FAQs identify as:
"A biometric or biometric identifier is a measurable physical or behavioral characteristic of an individual, which can be used to verify the identity of that individual or to compare against other entries when stored in a database. Biometrics include face recognition, fingerprints, and iris scans. The U.S. Electronic Passport uses the digital image of the passport photograph as the biometric identifier that is used with face recognition technology to verify the identity of the passport bearer. For more information on biometrics, please consult www.biometricscatalog.org."

Looking deeper, the Homeland Security Department's Privacy Technology Implementation Guide (PTIG) provides program developers and managers with steps to follow when implementing systems that use Personally Identifiable Information (PII). As this document says:
"The PTIG is not prescriptive. The guide does not mandate the development of any new system requirements."
"The PTIG is descriptive. It combines the elements of privacy protection that appear in disparate privacy compliance assessments, documents, and administrative policies and procedures into a single document, contextualized for managers and developers of operational systems."

Some key PTIG acronyms that keep popping up include:
PII - Personally Identifiable Information (what makes you "you"?)
PTA - Privacy Threshold Analysis (does this use cross privacy boundaries? Pg 21/36)
PIA - Privacy Impact Assessment (how far over the line is it? Pg 21/36)
SORN - System of Records Notice (project records of privacy use Pg 22/36)
SSN - Social Security Number (still heavily used by many US agencies and financial institutions)

Several references are to the Privacy Act of 1974, which is the legal basis for all things private in the US Government. It incorporates a bunch of holes that permit grandfathered use of info you would probably prefer to keep private.
For example:
"SOCIAL SECURITY NUMBER USAGE

Section 7 of the Privacy Act (found at 5 U.S.C. § 552a note (Disclosure of Social Security Number)) provides that:

'It shall be unlawful for any Federal, State or local government agency to deny to any individual any right, benefit, or privilege provided by law because of such individual's refusal to disclose his social security account number.' Sec. 7(a)(1).

Comment:

Note that although this provision applies beyond federal agencies, it does not apply to: (1) any disclosure which is required by federal statute; or (2) any disclosure of a social security number to any federal, state, or local agency maintaining a system of records in existence and operating before January 1, 1975, if such disclosure was required under statute or regulation adopted prior to such date to verify the identity of an individual. See Sec. 7(a)(2)(A)-(B)."

List of things considered "sensitive" (PTIG page 14 of 36):
"The following is a partial list of privacy sensitive technologies - technologies that specifically raise privacy issues either through the way the technology processes PII or through the nature of the PII used by the technology.13
• Biometrics. Biometric technologies involve the direct use of an individual’s physical characteristics and seek to establish the most reliable link between a person and information. The intimate nature and potentially permanent direct association of biometric information with an individual raises privacy concerns regarding risk to the individual from data loss and surveillance (involuntary biometric collection at a distance).
• Geospatial. Geospatial technologies involve the use of geographic information. Since every object and every individual is located somewhere, geospatial technologies can serve as a universal link between all other information, objects, events, and individuals. The ability to associate location with an individual over time along with all other objects and events associated with the same location raises privacy concerns related to tracking and profiling.
• RFID/Wireless. Radio Frequency Identification (RFID) and other wireless technologies involve the transmission of information through the open air. When these technologies are used to transfer PII or are associated in any way with individuals, these technologies raise privacy issues regarding surveillance and involuntary identification. The broadcast nature of the transmission and the association of that data traffic with an individual raises privacy concerns that should be addressed early in the project life cycle.
• Datamining. Datamining technologies generally involve the combination of large volumes of data of various types from many different sources. The potential to connect highly diverse information outside the context of the original collection and to predict characteristics of individuals raises privacy concerns related to data quality and notice. Privacy compliance requirements apply to all uses of PII within a datamining system, which means that the each use of each field of PII should be articulated to facilitate the appropriate level of analysis required to ensure privacy compliance."

Care and Feeding of your chip-containing ID device:
Do not bend, strike with hammer, or put in microwave

Synopsis: There is not one authority for determining what is private and what is not. Different agencies or groups have their own rules and interpretations to use as they see fitting the regulations. Analyzing use of privacy data use will result in additional promulgation of private information. The Homeland Security list of technologies considered privacy-"sensitive" indicates that these are currently available for use in government circles.

Face recognition video technology is not highlighted, but has been reported to be of limited use in Las Vegas, Nevada. Maybe they just want us to think that.
Posted 8:56 AM by Andy (1) comments

       Comments:

BTW - the technology used for radio frequency identification (RFID) chips is the same as car manufacturers use in their ignition keys to prevent an "unathorized" key from starting your car.

There is a little glass capsule in the plastic part of the key. It has a microchip and there is a copper wire wound around and around the inside of the capsule to act as an antenna. When you turn the ignition key, a ring antenna around the lock opening sends out a small pulse of radio frequency energy. The capsule uses that to power the chip which responds with an encrypted answering pulse that includes a digital number. The ring antenna around the lock gets that and sends it to the computer. The computer compares with the right code in memory, and if correct, tells the engine computer to turn on the spark and fuel injectors.

The vehicle starter will crank until it burns out, but the engine will not run until the secret code unlocks the computer.

The chip in the passport and other documents will work the same way, with pulses of radio frequency energy, and a digital code response.

# posted by  Andy : January 03, 2008 6:52 PM
 
Post a Comment


---