<< National Public Forum on “Enhanced” Drivers Licences, privacy and state surveillance under the new Canada-U.S. border regime Ottawa - March 24, 2009 Identity, Privacy and Security Initiative & Information Policy Research Program Faculty of Information, University of Toronto Andrew Clement, Krista Boa, Joseph Ferenbok, Brenda McPhail & Karen Smith RFIDs, Facial Recognition and other problems with “Enhanced” Drivers Licences

Overview  What is an EDL?  RFID capabilities  Border crossing waits  Facial recognition screening  EDL versus Passport  Summary - get a passport!

[1]

Demo of RFID reader RFID reader display Show read range

RFID Properties (EPC Gen 2) RFID EDL numbers are unique personal identifiers readable at a range of up to 10m RFID unique numbers are an access key to database records that contain personal information RFID unique numbers are personal information This equipment can also: –duplicate EDL tags –turn tag on and off –‘kill’ tag to prevent further reading EPC Gen 2 is insecure and privacy invasive in EDLs cloning self-protection or denial of service?

What Border Patrol will see: From Canadian (CBSA) database: RFID unique number >  Full name (first name, last name)  Birth date * Gender * Citizenship  License issuing jurisdiction  Issuing country * EDL expiration date  OCR/MRZ unique identifier  Digital image (Applicant photo)  License status and status changes From US (CBP/DHS/NCIC, ICEPIC…) databases:  Travel history?  Threat level?  Police record?  ??? ? ?

Vehicle Inspection Time Reduction? Will having an EDL rather than a passport save you time at the border? Using an EDL saves 5-10 secs over using a passport (which has a Machine Readable Zone (MRZ)) Also note:  No additional lanes at border crossings  No special lanes for EDLs No!

Wait Time Reduction? 75% MRZ/25% RFID i.e. barely any reduction in wait time [1]

FRT - Facial Recognition Tech (aka Photo Comparison Technology) Ontario DL(+ID) database ~10M records Image template

FRT - Facial Recognition Tech (aka Photo Comparison Technology) Mandatory for all drivers licences in some provinces (Alberta, Ont., B.C.)  Evidence for effectiveness?  Protection against false positives? Redress?  Security of the database?  Data sharing? Strictly limited and transparent?  Protection against function creep? See video at IDforum.ca

EDLPassport Cost~$50 > $87 Ease to obtain <> Ease to use > Wait time = Usefulness < Privacy < Security < Sovereignty <     EDL vs Passport

Summary - Get a passport! Four-part test Necessary Effective Proportionate Minimal FRT RFID ?    Passport Stop! Think again Still preferable Stop! Think again    

Check out the FAQ, webcast, videos and on-line discussion at: IDforum.ca [IPRP] Information Policy Research Program

References [1] CTST 2008 Passcard and Enhanced Driver’s License Panel Discussion, Track A14 Federal Government ID Use Cases, Paul Hunter May 13, 2008