Anti-fraud capabilities are touted as a major component of the proposed BC Services Card. While the government is almost certainly overstating the issue of fraud, the political rhetoric around fraud doesn’t inherently mean that proposed anti-fraud mechanisms will be similarly overstated. Indeed, many of the Services Card’s suggested changes could be helpful in limiting the issuance of fraudulent identity documents; adding a card holder’s photo, an expiry date, and anti-counterfeiting technologies to new medical CareCards could be quite helpful in ascertaining, and addressing, fraud levels. Unfortunately, the biometric systems that will also be linked to the Services Cards are unlikely to significantly defray fraud.
In this post I continue my analysis of the BC Services Card, this time with a focus on the cards’ integration with biometric analysis technologies. I begin by giving a primer on the origins of biometric analysis for identity documents in BC, and then move to outline how the government asserts that the biometric analyses should work. I then explain why adopting biometric identifiers matters: why don’t they tend to work? what is at stake in their inclusion? I conclude by (re)suggesting some entirely reasonable security processes that might defray fraud without needing the cards’ proposed biometric properties.
We’re paying for a high-tech Broadway show that’s themed around ‘security’, but we’re actually watching the equivalent of a catastrophic performance in a low budget community theatre. The price of admission? Only millions dollars and your privacy.
As of June 1, 2009, Canadians and Americans alike require an Enhanced Drivers License (EDL), a NEXUS card, a FAST card, a passport, or a Secure Certificate of Indian Status to cross a Canadian-American land border. In Canada, only Ontario, Quebec, B.C. and Manitoba have moved ahead to develop provincial EDLs; the Saskatchewan, New Brunswick and Prince Edward Island governments have all decided not to provide these high tech, low privacy, cards to the constitutencies (Source). To apply for an EDL in a participating province, all you need to do is undergo an intensive and extensive 30 minute face-to-face interview at your provincial equivalent of the Department of Motor Vehicles. Your reward for being verbally probed? A license that includes a Radio Frequency Identification (RFID) tag and a biometric photograph. The RFID tag includes a unique number, like your Social Insurance Number (SIN), that is transmitted to anyone with an RFID reader. These readers can be purchased off the shelf by regular consumers, and number your EDL emits is not encrypted and does not require an authentication code to be displayed on a reader. Effectively, RFID tag numbers are easier to capture than your webmail password.
This is almost a week old (things have been busy *grin*), but in case you missed it British Columbians can now apply for Enhanced Drivers Licenses (EDLs) for land and sea entry into the US. Enhanced Identity Documents (EIDs) will be made available for individuals who cannot, or do not wish to, carry a drivers license.
Something that is interesting: To get an EDL in BC will cost you $110 ($75 for a regular 5-year license plus an addition $35 fee); at that price, a passport ($87/92) is cheaper! It seems to me that getting and EDL at that price is just foolish; you still need a passport to fly into the US, and a passport is cheaper if you will both be driving and flying. EDLs (again) come off as a half-assed idea that don’t really accommodate Canadians, but are meant as a passport substitute for Americans who are far less likely to widely travel abroad than Canadians.
Quebec formally announced that EDLs will be available for Quebecers on Monday, with Jean Charest using a relatively bogus financial argument to support EDLs.* Says he:
“If there are five people, five kids and two parents, if they had to all pay for a passport it would be an expensive requirements for them to come here” (Source)
Not withstanding Charest’s poor math (I count seven people in his ‘equation’), the costs that he is referencing are for the people coming to Quebec, not the costs of Quebecer’s traveling to the US. Were he really concerned about costs, he could adopt the line that the OPC and IPC (Ontario) have been pushing: Canadian’s should have their passport’s subsidized, and the lifetime of these documents extended. Were he honestly concerned about the privacy concerns, he would be pushing passports, not EDLs. Fortunately, of course, Charest is a stanch ‘supporter’ of privacy:
“[Privacy is a serious issue. We believe we need to do what has to be done to protect the privacy of individuals” (Source)