In theory, as long as it meets the federal government's minimum requirement for a Real ID Card, each state could go with RFID or any other technology. According to TI, "we are not aware of any states that have said they will incorporate RFID in a Real ID card. Some border states have hinted they might, but there is not yet a definitive commitment or statement from any."
The smart card industry's argument against the use of bar codes for Real ID focuses on its technological inability to add future applications. Had a smart card technology been implemented, the Real ID could eventually serve also as, for example, a health card, library card and digital signature, said Wiley.
As for the Pass Card, the smart card industry objects to the government's choice of RFID technology because the EPC Gen 2 tags do not include extensive protection against cloning or counterfeiting.
Because the EPC Gen 2 allows cards to be read at a distance of up to 30 feet, the Department of Homeland Security regards it as efficient for processing people in vehicles quickly. However, while the RFID technology supports 32-bit passwords to protect data written on the tag, it does not use government-approved encryption algorithms. DHS plans to offer "privacy protection" by placing a unique ID number on the card and using the number to retrieve personal information (a photograph and demographic information) from a central database when the card is used at a border crossing.
This effectively means that Pass Card holders' identification number can be stolen from a distance with relative ease. A stolen ID number can be programmed on a blank chip or programmed in an RFID reader, with the reader then acting like a chip by spitting out the false ID number.
DHS has also opted for RFID technology due to the already available infrastructure in Canada. Wiley said those existing readers now need to be replaced by new readers compliant to EPC Gen 2. Besides, as ePassports adopt a contactless smart-card technology based on ISO/IEC 14443, borders checkpoints will eventually be equipped with new smart card readers.
In deciding between Real ID, Pass Card and ePassport, the bottom line is cost. RFID tags cost 10 to 15 cents per tag. A smart card chip equipped ePassport costs $2.
According to Bruce Schneier, a security technologist, "Security is always a trade-off; it must be balanced with the cost." He added: "We all do this intuitively. Few of us walk around wearing bulletproof vests. It's not because they're ineffective, it's because for most of us the trade-off isn't worth it."
Schneier said the new identification card is "another lousy security trade-off." He added, "For the price, we're not getting anywhere near the security we should."