A passport card set to be issued by the State Department for travel to Canada, Mexico and the Caribbean doesn’t require privacy protection, even though it uses a radio frequency identification chip which can be read from 20 feet away, because the chip itself doesn’t contain personal information, according to the director of the National Institute of Standards and Technology.

NIST director William Jeffrey said that because the RFID chips will only contain a unique reference number which points to a database entry, the passport cards don’t need to be encrypted or to have other safeguards for protecting personal information.

But RFID industry and computer security experts disagreed, saying that even the reference number could be used to compromise Americans’ privacy and security at ports of entry and abroad.

“Strong encryption was deemed unnecessary due to the lack of information on the Radio Frequency chip outside of the pointer to the secure Department of Homeland Security database,” Jeffrey wrote in a May 24 letter to the Smart Card Alliance, an industry group.

NIST also concluded that since the RFID chip contains no personal information, the card architecture for the PASS card is not subject to international standards regarding protection of personal information on smart cards and other types of identification cards.

“The card architecture will contain no technology to collect, store and share personal information,” Jeffrey wrote. — Washington Technology

But even a single number readable from 20 feet away could jeopardize the safety of Americans traveling abroad, experts said.

NIST “is making the very mistakes the Data Privacy and Integrity Advisory Committee warned about,” said security expert Bruce Schneier, who served on that committee when it released a report recommending against the use of RFID in identifying people.

And Smart Card Alliance executive director Randy Vanderhoof laid out the problem succinctly in a statement last year: “Unlike electronic passports, which have built-in security features, a free read of a unique reference number at long distances opens possibilities to identify or even track U.S. citizens.”

The Smart Card Alliance said that the government failed to follow best practices for using RFID in identity applications, and recommended that the government use short-range RFID chips which have only a range of a few inches.