By on May 11, 2009

Here’s a story that proves that incompetence and general apathy isn’t limited to the DMV where Patty & Selma Bouvier earn their living. Starting now, Quebec motorists can offer up $51.97 above the current cost of a driver’s license to obtain what the provincial government is calling “Smart” driver’s licenses. These licenses will come equipped with an RFID chip that can be scanned remotely by US border guards to identify approaching drivers. Introduced by Quebec’s version of a DMV, the SAAQ, these chipped IDs are meant to allow Quebecers to comply with new Department of Homeland Security regulations that require government-issued identification when entering the US by land. Here’s the problem: The (highly personal) information emitted by the RFID can also be read by anyone else who, with $250 and a working knowledge of eBay, can obtain the necessary equipment. To make matters worse, no encryption or security measures were implemented on these “Smart” licenses. Needless to say, it’s an identity thief’s wet dream.

In a study conducted by the Montreal daily, La Presse, a security consultant was able to record information from several nearby licenses, all while driving aimlessly on the highway. According to La Presse: “It only takes one hidden radio to clone anyone’s license.” In the same tests, a security consultant was able to record license information from as far as 15 meters away.

In its response to criticisms that the “Smart” licenses may, just may, create some privacy issues, the SAAQ notes that it provided motorists who’ve applied for the enhancement a special slipcase for the license that blocks all transmissions. You know, except when you take it out to show a US border guard, or a liquor store clerk, or a bank—wait a minute.

In the meantime, former federal Transport Minister and current radio jockey, Jean Lapierre, suggested, in an interview with Montreal’s CJAD 800 AM on May 7, 2009, that Quebecers should apply for a Canadian passport instead, which suits the DHS just fine and doesn’t broadcast any personal information. Since a passport application costs $100, for another $48.03 over the incremental cost of a “Smart” license, you get the ability to actually take a plane somewhere too!

Get the latest TTAC e-Newsletter!

39 Comments on “Canadian Smart Licenses Raise Privacy Issues...”


  • avatar
    paris-dakar

    Mary Jane Doe is kind of cute.

  • avatar
    ohsnapback

    Great.

    Look for the same incompetence on this side of the border (the U.S.).

    Hey, is the ‘chip’ or ‘mark’ that the bible talks about?

  • avatar
    tced2

    The new US passports have a similar problem with their RFID chip.
    But the entrepreneurs have come up with a solution – a slip case that shields the chip from being read. The credential must be removed from the case for reading.

  • avatar
    Rastus

    What is disturbing is the readers may be placed in ANY innocuous location…for example, in door frames of department stores, in the tile under your feet, etc.

    If the proliferation of CCD cameras are any example, look for the readers to be ubiquitous…that is, everywhere.

    They already have so-called “fusion centers”. These data-monitoring/archiving centers are much like CIC (Command Information Center) aboard a war ship- their purpose is to collect data from all-encompassing “sensors” (red-light cameras, speed cameras, license plate readers, credit card purchases, etc) and “fusing” the disparate information…with the sole intent of tracking and monitoring your EVERY MOVE.

    http://www.it.ojp.gov/default.aspx?area=nationalInitiatives&page=1181

    And of course they will sell this as a tool for “public safety”.

    You’re not AGAINST “Public Safety”, are you??? Come on now!!

  • avatar
    paul_y

    I suspect that when I get my license renewed in July, I’ll be wrapping the Enhanced Driver’s License my company is obliging me to get (I can expense the added cost) in foil most of the time, other than when I need it out of my wallet.

  • avatar
    superbadd75

    You mean to tell me that for less than $52 I can experience the total devastation of having my identity stolen? Sign me up!

  • avatar
    grifonik

    Not that I’d get one even if it was “secure”… But, I wonder what information is being gleaned from the card?

    Name and address alone aren’t going to lead to identity theft. DOB, can be somewhat dangerous as it is often used as a challenge/response for phone verifications. DL#, not sure that’s useful for anything since its typically not like the SSN anymore?

    They must be transmitting more info than the card actually displays? Probably canada’s equivalent to the US SSN?

  • avatar
    yankinwaoz

    where Patty & Selma Bouvier earn their living

    *snort*
    Love it! Thanks!

  • avatar
    Dimwit

    I wonder if Ontario’s Nexus card has the same problems.

  • avatar
    Rastus

    “But, I wonder what information is being gleaned from the card?”

    grifonik, the answer to your question lies in “where you are and what are you doing, etc”.

    Ok, it’s one thing to glean a “driver’s license number”…it’s quite another thing to know exactly where you are with this information stored on a computer somewhere….with the ability to recreate your every move for say, the last 8 years.

    Combine this with cc transactions, cell phone calls (with gps tracking), etc….you may as well jump through the pages into the world of Orson Wells.

  • avatar
    Bill Wade

    tced2 :
    May 11th, 2009 at 5:19 pm

    The new US passports have a similar problem with their RFID chip.
    But the entrepreneurs have come up with a solution – a slip case that shields the chip from being read. The credential must be removed from the case for reading.

    A couple of seconds in the microwave fixes the issue.

  • avatar
    dkulmacz

    Err… do you mean ‘George Orwell’?

    Or perhaps Orson Bean?

    Mr. Bean?

  • avatar
    ohsnapback

    I feel so much more secure already.

    Thanks, government!

  • avatar

    I live in the same state as Mary Jane Doe, within a slapshot of the US/CDN border, and they’re advertising the same thing, calling it an ‘Enhanced’ driver’s lic. and pitching it as an alternative to a US passport for crossing the Canadian border. Back before 9/11 it was quite easy and I used to book flights out of YVR instead of SEA due to better choices and frequently lower cost, especially to locations overseas. Not so any more. The border crossing is now a royal pain the ass, more so southbound, but well worth avoiding at all costs. My problem with this “enhanced” license is that it DOES NOTHING to lower border crossing times. You still have three miles of cars backed up to MAYBE two of ten gates open at Blaine or Sumas. If it were like the old NeXus pass with it’s own dedicated lane I might choose to risk my civil liberties for the sake of convenience. Not likely, so I’m not going to pony up the extra cash.

    –chuck

  • avatar
    GS650G

    No way is Mary Jane Doe 52 years old.If she is I want whatever she is taking.

    On a serious note, first this is optional then it isn’t. This is another trial that will become mandatory eventually.

    Technology is a great tool but in the wrong hands it can be bad.

  • avatar
    don1967

    As a Canadian it pains me to say this, but the security concerns of “smart” licenses will be lost on most of the population up here. The logic is “I have nothing to hide, so who cares?”.

    Merely pointing out the risks is enough to get you branded as a right-wing nutcase in the Land of Big Government, so I just smile and nod politely.

    PS: Paris-Dakar, the good news is that she lives on Your Street.

  • avatar
    ohsnapback

    There’s no way Mary Jane Doe weighs a buck fifty…

    …I say 130 tops, and most likely less.

    Hey, maybe if people complain loudly enough about what a stupid idea it is to have so much information stored on an accessible, remote chip, ready for the criminal elements to simply take from the airwaves, elected officials will nix this and come up with a much more logical plan?

    Wait. Never mind. I was dreaming again. I hate when that happens.

  • avatar

    Saskatchewan recently abandoned its project to have a similar product, quoting concerns about privacy, compliance with Canadian privacy legislation, and security issues, as well as cost (the product would cost more than $50, not much less than a proper passport). Although a lot of money had been sunk into the project, the provincial government decided that the passport ended up making more sense especially as the cost of the special driver’s license went up.

    Of course, that doesn’t address the issue that the US-Canadian border is getting harder to cross and European borders are getting easier to cross. There is this delusion that Canada is insecure and lets all sorts of wild people in. Many (including some high up in the US government) believe the 9/11 plotters entered the US through Canada. In fact, none of them did. The only known terrorist to attempt to cross the US border from Canada was the person who wanted to bomb LAX airport and tried to cross at the BC/WA border south of Vancouver. Clearly both of our countries can let idiots in, but I don’t see how that one example demonstrates that Canadian border security is lax.

    In any event, the closing border is going to result in fewer people crossing it. The US benefits far more from Canadian tourism than Canada benefits from US tourism, so ultimately this is going to hurt the US much more than it hurts Canada.

  • avatar
    Gardiner Westbound

    There is this delusion that Canada is insecure and lets all sorts of wild people in. – PhotoJim

    The people who closed Toronto’s University Avenue for several days last week and the Gardiner Expressway overnight to protest a foreign civil war might qualify as wild. How did they get in?

  • avatar
    Guzzi

    paris-dakar :

    Mary Jane Doe is kind of cute.

    She sure looks good for 52. Turns out there is a lot of mary jane in Olympia, er, Capitol City, WA.

    I thought about one of these a few months ago when I was renewing, but the extra dough, extra appointment/background check, plus the extra $ for my motorcycle endorsement, I took a pass. There but for the grace of god…

  • avatar

    I have many unkind things I could say about the pig-headed Orwellian Quebecois state after living in Montreal for three years. Needless to say, this kind of dunderheaded disregard for the sanctity of a citizen’s privacy is hardly surprising. Unfortunately they can do whatever they please, so long as the poor sap signs the form and gives his/her consent. The SAAQ is Satan incarnate (as a bureaucracy) as far as I am concerned.

  • avatar
    eh_political

    I think it’s a pity that any additional documentation is being required at the Can/US boarder. It’s almost entirely about creating a surveillance society, not security.

    Once you get past the headaches with RFID identity theft problems, there is a more significant issue. If you spot a Canadian license plate in the US, or an American plate in Canada, then you know there is an opportunity to obtain a number of passports. Between theft and loss, the number of official documents in criminal hands will skyrocket.

  • avatar
    kovachian

    paul_y: don’t forget to save some of that foil for your hat.

  • avatar
    Samir

    Jim I agree. After my next trip (Vegas, this September), I’m basically crossing the US off the tourism list for a good while. I got tired of staring at GWB’s portrait at the border for 2 hours last time I wanted to go to Applebee’s in Upstate NY and the guards couldn’t wrap their minds around the fact that my travelling companion visited his grandfather in Pakistan – and did not actually attend an Al Qaeda camp.

    Unfortunately, business travel to the US will continue.

  • avatar
    MagMax

    I already have a Nexus pass and have never had a problem, at least not that I know of. It’s always inside its little sleeve. And I just applied for the British Columbia enhanced driver’s license. It’s just much easier to use that than bringing a passport along just to cross over to Bellingham WA. You don’t dare leave the passport in the vehicle and it’s bulky to carry around. I wonder if the BC enhanced driver’s license is also subject to the same security issues as the Quebec card? Why wouldn’t they have included adequate encryption in these things? I guess I shouldn’t be surprised.

  • avatar
    Geo. Levecque

    For the info of the writer who wondered about Ontario “Nexus” Card, Ontario has the same deal as does Quebec, an ehanced Driver’s License, thus probably the same problems, its much better to have a Canadian Passport, at $87.00 Canada its better value imho! In Europe the only Country you need a Passport for is the United Kingdom, after that all of the EU Countries are more or less clear sailing if you live in the EU, Passports are only required for foreigners.

  • avatar
    TireGuy

    You have a slight misconception about what information RFID chips are communicating. They are not communicating e.g. “I am John Doe, age 45, living in …”. They communicate basically “12345″. You need the respective electronic device and software to translate such numbers into the information needed.
    Therefore, the discussion about alleged “privacy” issues from RFID tags runs in the wrong direction.

    If it is possible to “copy” the info from the card, it still remains mostly useless. it may be that there is possible misuse if someone with a card with such number e.g. crosses the border, leaving a trace that allegedly someone else crossed – if that is possible, then this might require some attention. Overall, however, I see this not as critical.

  • avatar
    Kurt.

    @TireGuy,

    You are partially correct but just look as Satellite TV as an example. Broadcasters change the encryption regularly yet hackers put out the software decryption within days, sometimes hours of the change.

    When the US Military went to the Smart Cards for their ID’s, encryption of personal information was a big issue. We went to a mandatory briefing at Eglin AFB where they proceded to tell us that it was encryted and safe, yet I had already downloaded the decryption and had it on a 3.5 floppy. Granted, not much was on the cards that you couldn’t get elsewhere but it was the casual attitude to our personal information and the belief in their process that bothered us.

  • avatar
    ZoomZoom

    I’m telling you folks, the “homeless sign guys” have it solved. You don’t need to carry any smart id cards or a drivers license if you have nothing, own nothing, don’t vote, don’t make money, don’t pay taxes, and just show up at the church for your weekly sermon, a hot shower, and soup from the big kettle.

    An advanced, pre-adapted life-form? You be the judge!

  • avatar
    TireGuy

    Kurt.:

    the poinst still is, that there is no sensitive information on the card itself, other than set out in your example. Someone who wants to decipher the information needs access to the relevant database. RFID is currently being developed especially for the trade companies. There e.g. you have today the EAN number for each product. With RFID, you add a few numbers to improve tracing the product. Still, with the information you have nothing more than when you look on a scanning bar of a product – which tells you exactly nothing. For a product which sends out RFID information you then need the trade companies database which is e.g. linked to the cashier, and states that a certain number means e.g. a 1 gallon bottle of milk.

    Clearly, the fear of RFID comes from the fact that is is not understood how it works.

  • avatar
    Rastus

    All you have to do is perform a patent search and the like for how they intend to use RFID.

    http://www.spychips.com/press-releases/american-express-conference.html

    http://www.spychips.com/

    Employee badges anyone? Hey, if the boss wants to know how much time you spent on the crapper last month, he now has that at his disposal. You want to slip out of work and meet someone for dinner without being logged and recorded in a database?

    The uses are endless. You may as well be a heard of tagged cattle.

  • avatar
    psarhjinian

    Not so any more. The border crossing is now a royal pain the ass, more so southbound, but well worth avoiding at all costs.

    +1

    I used to live within, oh, ten minutes of the Canada/US Border at Niagara On the Lake/Lewiston. When I’d go over to a friend’s house who lived on the parkway, I could, literally, throw a baseball and hit New York. With little more effort I could boat across the Niagara (or swim, if I was suicidal). I never, ever thought of it as a real “border”, especially when I was puking out the window and onto the Peace Bridge at 3am after getting stinking drunk at one of Niagara Falls (NY) fine establishments (that don’t check for ID)

    Treating the US/Canada border like, oh, Mexico’s is stupid and comes as the result of pandering to landlocked states who have no idea what the US/Canada border looks like, or what kind of traffic flows across it. Hints:
    * Illegal aliens are not really a problem
    * Terrorists are not a problem. No, really. The attempts to infer otherwise are lies
    * Canadians stealing American jobs via NAFTA isn’t a problem (the reverse isn’t true)
    * Methamphetamines, weed and lesbian erotica are a problem, but the US more than makes up for it with cocaine and handguns, so fair’s fair.

    We’re talking about the largest undefended an geogrpahically non-delinated border on the planet. It’s very long, largely impossible to patrol and actually bisects several towns. Trying to implement Fortress America, especially while Europe is tearing down international borders, is a study in futility. But I’m sure it keeps the DHS looking busy.

    Cards like this are a collective “Oh, well, if we must…” from the various provincial governments after years of lobbying. It’s easier than getting a passport, and someone from Podunque, QC is more likely to have one—though I know from talking to people in Stowe and Burlington VT that they’re certainly concerned more about Quebecois tourist revenues than about terrorism.

  • avatar
    psarhjinian

    The uses are endless. You may as well be a heard of tagged cattle.

    Tin foil makes all your problems go away. Unless you work in warehousing, in which case tin foil wrapped around RFID tags is a good way to steal inventory.

  • avatar
    Rastus

    Ok, so you’re going to wrap your passport or driver’s license in tinfoil. Great!!

    Now what are you going to do about the RFID tags sewn in your clothing? You know, the RFID tags which you know nothing about as the manufacturer surely doesn’t make mention of it. The RFID tags about the size of a grain of sand which are innocuously hidden so you can’t find them?

    And yes, there is clothing out there already with RFID tags. As one of the poster’s above made mention of, they like to perform “trial runs”.

    http://www.spychips.com/RFIDclothingstoredemo.html

  • avatar
    dean

    I’m pretty sure the picture is of Fran Drescher, who played “The Nanny” on tv back in the ’90s.

    FWIW.

  • avatar
    TireGuy

    Rastus:

    that webpage is still ignoring facts. The quality of the site is already shown when spelling the word “reciept”…

    RFID tags are not “tracking devices”. They do not by themselves e.g. say “this is a T-Shirt”. The RFID chips says “12345″ – and the checkout counter uses this to translate that this is a t-shirt in blue from GAP… or whatever.

  • avatar
    Rastus

    Disregard at your own peril.

    I misspell on occasion too…what’s the big deal? It happens. I even sometimes catch myself making errors in my posts and don’t feel like going back and correcting it. It’s part of being human.

    Re. the topic at hand: there’s a such thing as “data”…and there’s a such thing as “meta data”. 12345 may be considered data. But where that 12345 came from, which geographic location, who is wearing 12345, what that person’s street address is, date of birth, FICO score…you name it…it’s all there. These are examples of meta-data.

    That’s what databases are for…for correlating data. I’m not trying to insult your intelligence, but I think you fail to see the overall big picture.

    See…I should have said “… don’t feel like going back and correcting THEM”. Many people, including myself, type loosely online. It may be a reflection of my casual attitude and not so much a reflection on my education :)

  • avatar
    Robstar

    How hard would it be to have your own radio signal that overpowers any RFID chips near you & gives out false data?

    Does RFID use a licensed band?

  • avatar
    denca1

    I say that when we all have the chipped cards and our identity gets stolen that we should sue our government for mandating the chipped cards in the first place and the government can pick up the tab of expenses incurred against our name.. Maybe then this will change but enough people have to make this change.


Back to TopLeave a Reply

You must be logged in to post a comment.

Subscribe without commenting

Recent Comments

New Car Research

Get a Free Dealer Quote

Staff

  • Authors

  • Brendan McAleer, Canada
  • Marcelo De Vasconcellos, Brazil
  • Matthias Gasnier, Australia
  • Tycho de Feyter, China
  • W. Christian 'Mental' Ward, Abu Dhabi
  • Mark Stevenson, Canada
  • Faisal Ali Khan, India