Despite widespread privacy concerns, several Canadian provinces are pushing through with the implementation of the enhanced driver’s license (EDL) scheme that seeks to link U.S.-Canada border security measures.
In January, British Columbia became the first province to implement an EDL pilot program in conjunction with Washington State. The province currently has some 500 EDLs activated.
Saskatchewan, Manitoba, Ontario and Quebec are working on their own version of radio frequency Identification (RFID)-enabled drivers’ licenses with embedded personal ID and citizenship information.
The programs are an offshoot of Washington’s Western Hemisphere Travel Initiative (WHTI) that requires travelers to the U.S. to carry a passport or equivalent ID to enter the country starting June 2009.
RFID or radio wave-based technologies are used to tag and track objects and people. Information from simple numbers to complex data is implanted on a microchip that can transmit signals to an RFID reader.
EDL proponents say embedding required data into a driver’s license that can be read by an RFID scanner from several meters away will eliminate the need for manual passport inspection by border agents.
This, they say, will significantly speed up border crossings.
As an EDL will contain citizenship data, the card would serve as an alternative to a passport, providing non-drivers with a photo ID card equivalent to a driver’s license.
But civil liberties and public advocacy groups on both sides of the border say that such a system is riddled with flaws. They warn it could lead to racial profiling, breach of privacy, and even ID theft by cyber criminals armed with their own RFID scanners.
“This program will essentially enroll Canadians into a national ID program developed by the U.S. Department of Homeland Security,” says Stuart Trew, regional organizer of the Ontario and Quebec Branch of Council of Canadians.
The Council is an Ottawa-based citizens’ advocacy organization with more than 70,000 members across Canada.
While for now enrolment is voluntary, Trew says down the line it’s likely to be made a requirement – one that would create multiple categories of travelers.
He said once the program becomes widespread, it would be all too easy for border agents to consider all non-EDL holders suspect.
Like many civil liberties activists, Trew believes such “enhanced” licenses have little anti-terrorism value, and can in fact expose holders to possible identity theft.
For one, the system’s effectiveness depends on other ID-type documents – such as birth certificates – that the EDL will be associated with.
In the U.S., for instance, sources of these diverse documents rarely interact, and it’s easy to gain access to spurious documents.
The EDL system developed for the DHS by Digimarc Corp., a Beaverton, Ore-based company, does not support encryption and allows information to be read from a distance of up to 20 feet.
RFID readers can do a blanket scan of multiple card holders even from a traveling vehicle, Trew noted.
“The readers are designed to harvest data from afar,” said Trew. “What’s to keep criminals from using their scanners to trawl for ID information from unsuspecting card holders?”
He said there have actually been trials where this type of identity theft was proven to be easily accomplished.
Digimarc was unavailable for comment.
But the notion that cyber criminals will be able to steal card holders’ personal information was refuted by David Oved, communications adviser to Jim Bradley, Ontario’s Minister of Transportation.
“This doesn’t represent a security risk, since the RFID tags on the cards only emit a unique card holder serial number, not personal information.”
The actual information about the card holder remains in the database, Oved said.
The ability to scan for the numbers from a distance is actually meant to reduce the time it takes for border agent to bring up on the computer screen a traveler’s file, he said. The idea is to have the files ready before the traveler faces the agent. This, will hopefully, reduce cross border lineups.
An RFID expert agrees.
“RFID tags are nothing more than barcodes,” noted Marc Giroux, systems engineer for Symbol Technologies Inc., of Holtsville, NY. “A person without access to the database that interprets the barcode cannot access any personal information,”
He likened the situation to having a person’s license plate number. “Without access to the database, all you’ve got is a bunch of numbers.”
For determined identity thieves correlating an EDL serial number with a person’s private information is relatively easy even without hacking into the associated database, according to Andrew Clement, professor of information studies at the University of Toronto.
Clement spoke on the topic of EDL at the Canadian Identity Forum recently held in Toronto in conjunction with the Ontario Privacy Commission headed by Anne Cavoukian.
“People leave bits of their identity everywhere they go or with every transaction they make. For example, a criminal can easily link an EDL serial number to a holder’s other personal information.”
Serial numbers associated with an individual’s EDL, Clement said, should be considered and receive appropriate protection just like an IP address which the Privacy Commission considers part of a persons personal information.
Clement said for a substantial number of Canadians, passports still constitute a viable and secure ID document.
Rather that produce EDLs, provinces should consider embedding information-bearing magnetic stripes on passports or ID cards. Under this system, holders can swipe the passports or ID cards on readers at a border guard’s station to bring up the traveler’s file. “This way the holder controls the release of information and there is less chance of the data being intercepted by ID thieves.”
“RFID is an effective technology for managing the supply chain and tracking livestock or objects not people,” he said.
Another serious issue is the security and origin of the database containing the traveler’s information. Databases both private and public have been breaches numerous times in the past both by external and internal operatives.
In the case of EDL’s Canadian’s personal information will likely reside in U.S. government databases as well, Clement said.
The database issue was, in fact one of the concerns recently raised by Canada’s federal and provincial privacy commissions
No EDL project in Canada should proceed on a permanent basis unless the personal information of participating drivers remains in the country, according to a joint resolution passed by the privacy commissioners late last month.
The resolution also called for “meaningful and independent oversight” of how the U.S. Customs and Boarder Protection receives and uses the personal information of Canadians.
This would include regular reporting of oversight activities and corrective measures to the Canadian government and the Privacy Commissioner of Canada.
The U.S. government is well within its rights to impose such stringent requirements, and the Privacy Commission is powerless to stop it according to Trew.
“We feel the Privacy Commissioner alone doesn’t have the authority to stop U.S. authorities from storing Canadian private information in U.S. databases.”