Today I picked up my new Dutch passport, which includes an RFID chip. This chip contains sensitive information about the owner (or rather user, since the official owner is the Dutch government) of the passport, in this case me. The information can be read in a contactless way, i.e. from a distance, without a need to insert the passport in some kind of machine.

Although secure messaging is used to protect the wireless communication between RFID tag and scanner, it is still a wireless signal. This means the tag can always be attacked by a wireless signal. All you need is to be in close proximity to the passport. A simple attempt to contact and read the chip doesn't succeed in actually reading or deciphering the contents, it is still a major risk. With an old fashioned passport, I could easily determine who I gave access to the information contained therein. I would lock up the physical passport, I would only willingly open it to people so they could see the information. And if someone took my passport for a while (to make a photo copy or whatever), I would know. With the new chip, I have no way of knowing if someone managed to access my data. So what to do about this?

I sent a mail to ask my local passport office for help on this and I wonder if I will hear about any way to protect the chip from being read. The information leaflet that comes with the passport did not contain any information on this. There are some manufacturers selling special wallets or cages that are supposed to block access to the chip, such as the one by DIFRwear. $18 doesn't sound too bad to give it a try. It seems there are locations in the Netherlands where one can read the contents of the chip. Perhaps I can use one of those to see if the case actually works.