EDL

Update: ‘More Secure’ (non-EDL) Drivers Licenses Coming to BC Soon!

/ Christopher Parsons

200902131709.jpgAs I’ve written about before, Enhanced Drivers Licenses (EDLs) are coming to British Columbia, as well as many other provinces around the country (I have a wiki page set up to collate information on EDLs). It seems that, at the same time the BC is rolling out EDLs, they are updating their ‘regular’ licenses.

The Canadian Press is reporting that these new licenses will be available in March, and include:

holographic overlays and laser-engraving or raised elements such as the cardholder’s image and signature…The B.C. government said the cards will incorporate technology that analyzes characteristics that do not change, such as the size and location of cheekbones and the distance between the eyes. This “facial recognition technology … will enable ICBC to compare a cardholder’s image with their existing image on file and with the corporation’s entire database of millions of images.” (Source)

Continue reading →

Update: Ontario EDL Suppliers Named

/ Christopher Parsons

200902042317.jpgDr. Ann Cavoukian, the Ontario Information and Privacy Commissioner, announced yesterday that GND (located in Munich) would be responsible for producing Ontario EDLs. Further, she is working with the company Peratech to develop an on/off switch that would enable or disable the EDL RFIDs. As of yet, Peratech only has their technology working with contactless smart cards (i.e. cards with a 10 cm range), but they expect to overcome this. Ann is presently in talks with DHS to let them build the Peratech solution into the EDLs – this ‘privacy protective’ feature is not currently in the EDL spec. This is part of her ‘PETs Plus’, or ‘positive sum’ approach to security and privacy.

Update: Manitoba and EDLs

/ Christopher Parsons

200902011558.jpgFirst, and totally off-topic: I had no idea just how beautiful the Manitoba legislative buildings were!

Now, on-topic. Manitoba is moving forward with its planned deployment of EDLs, with residents of the province being able to apply for the card starting February 2nd, 2009. The government has apparently been working with the privacy ombudsman, but to date I haven’t found anything about those consultations. Perhaps this is another time where Access to Information claims need to be made?

Comment: To RFID or not to RFID, that is the question

/ Christopher Parsons / 1 Comment

The Vancouver Sun has an article that was written by Phil Chicola, U.S. Consul General in Vancouver. Entitled “To RFID or not to RFID, that is the question,” it is yet another part of the ongoing propaganda war surrounding the embedding of RFID chips in regular consumer products. In the recently released Canadian Border Services Agency (CBSA) Privacy Impact Assessment of the Enhanced Drivers License (EDL) program, we find that,

An effective external communications strategy will be developed by the [Provinces and Territories] with the assistance of the CBSA to ensure that the Canadian public is made aware of the significant privacy safeguards that will be put in place and the constraints that will be imposed on any subsequent use of personal information, especially sharing with the U.S. in consideration of the U.S.A. Patriot Act (29).

What this has amounted to in Ontario has been a persistent insistence by government officials that because the Radio Identifier that EDLs emit is not tied to any *other* piece of government information (e.g. the RFID number is not generated from an association with your driver license number, birth certificate, etc.) that the identifier isn’t personal information. Thus, while you will be broadcasting a number from your drivers license to anyone with a reader, that isn’t ‘personal’. Let’s turn to the Vancouver Sun article, and see how it squares up with the Canadian propaganda, shall we?

Continue reading →

EDL Update: Canada backpedals on sharing personal database with U.S.

/ Christopher Parsons

An update to my last post concerning the location of the EDL databases: Jim Bronskill, with the Canadian Press, is reporting that the CBSA and Canadian authorities are shelving ideas to place the EDL data in the United States. While this certainly alleviates some of the privacy-related concerns with the EDLs, the Office of the Privacy Commissioner of Canada put it well:

“All in all, we are pleased to see that they listened to some of our recommendations, but we remain hopeful that they’ll heed to many of our other concerns,” said Anne-Marie Hayden, a spokeswoman for Stoddart. (Source)

It is nice to know that a massive amount of personal information isn’t being stored in the US for cost management reasons, but this doesn’t alleviate worries that the RFID chip in the EDLs might still be used for mass surveillance purposes. While the privacy commissioners of Canada have recently commented on this to the press, warning businesses that they need to be compliant with law when collecting license information, their need to publish this statement clearly suggests that businesses are not remaining compliant with the law concerning non-RFID licenses. To me, this suggests that there either needs to be some very real coercive ‘convincing’ applied to businesses so that they learn to comply with the law, or that this issue should be used to publicly advocate for modifications to the proposed EDL schemes (e.g. being able to disable the RFID with an on/off switch).

EDL Update: Privacy Impact Assessment Released!

/ Christopher Parsons

Under a Freedom of Information request, the Privacy Impact Assessment (PIA) for the initial tests with Enhanced Drivers Licenses (EDLs) has been released to the public. I would highly recommend taking a look at the documents if you’re interested in this issue. Over the next few days and weeks I’m going to be (briefly) posting notes on the document. For more information, I’d recommend turning to the Canadian hub for advocates campaigning against the EDLs, at the Canadian IDentity forum.

I have a real passion surrounding databases – they are used to guide daily practices, from accessing money at instant tellers, to authenticating you to web sites that you visit, to identifying the cost of products when they are scanned at the grocery store. Databases are big business, and when it comes time to deploy new pieces of identity infrastructure the database chosen is important, as are the security precautions that surround it.

Continue reading →