Certain conspiracy theorists don’t trust the electronic identity and residency cards we are all obliged to carry around with us if we live in Belgium. They claim that the radio frequency identification (RFID) chip in the cards that contains the holder’s personal data is a “tracking device” that the authorities can use to “follow you wherever you go”. VRT News’ Fact Checker Unit looked examined these claims and concludes that it is practically impossible that the e-ID cards could be used as tracking devices.
Numerous films and texts warning is not to trust the trust e-ID cards have been doing the rounds on social media for some time. Conspiracy theorists describe the cards as “a slaves’ passport” and a “tracking device” that the authorities wish to use to keep tabs on our ccomings and goings.
"The new ID cards are all equipped with an RFID chip without people knowing. [...] The authorities oblige you to get one of these ID cards and always to have it with you. So, with the RFID-chip on your ID card they can follow you everywhere”.
People are even advised to put their ID card in the microwave or to prick a hole in the chip with a needle in order to make the dreaded RFID chip “safe”.
Is there any truth in any of this?
What is it all about? On the internet there are items and posts to be found warning people that the contactless RFID-chips that are integrated into Belgian e-ID cards enable the authorities to “follow people everywhere they go”.
But? This is impossible as the data contained on the RFID tags in the identity cards can only be read up to a distance of 10cm. Furthermore, other security mechanisms that are in place protect the data stored on the e-ID cards.
What is an RFID chip?
For many years now Belgian identity cards have contained a chip containing data that can be read by a card reader. However, some people were surprised when at the beginning of 2021 all new identity cards issued by municipal authorities across Belgium started to be equipped with a second chip, a so-called RFID-chip.
RFID or "radio-frequency identification" is identification via radio waves. Certain personal data and other information such as the holder’s profile photo and their fingerprint are stored on the contactless chip with an antenna that is contained within the card.
RFID technology and NFC (Near-field Communication") technology that is very similar are used in all kinds of everyday applications such as contactless payments using bank cards, staff access badges, bus tickets and anti-theft tags used in shops.
The Belgian Interior Ministry says that the RFID chips have been incorporated into identity cards in order to ensure that border controls can be “easier and more secure”. The incorporation of the chips into the cards came about largely due to a European directive issued in 2019.
How is the data contained on the RFID chip on your e-ID read?
Some people fear that the RFID tag contained in the e-ID card could be used by those with ill-intent or even by the authorities to track and trace people’s movements.
However, not just anyone can read the data contained on a person’s e-ID. Moreover, sensitive personal data such as an individual’s fingerprint are protected by special security certificates. The means that only public bodies that are legally entitled to do so, for example the police, have access to the data contained on the RFID chip on an e-ID card. In order to be able to access the data those working for these bodies require personal authorisation. Private organisations and individuals cannot access the data contained on the e-ID chip.
Furthermore, in order to access the data contained on the RFID chip you have to have the e-ID that contains the chip with you physically.
The Federal Interior Ministry explains that "The person reading the data first requires a password that is generated based on the so-called “Machine Readable Zone” that is printed on the back of the e-ID card."
Can data contained on RFID chips be read remotely?
Yes. Certain RFID tags can be detected metres away. However, the range of the RFID tags contained in Belgian e-ID cards is limited to 10 cm. The e-ID cards issued here follow the international ISO/IEC 14443 standard that limits their range to this.
The same ISO/IEC standard is applied to biometric passports and almost all identity cards issued withing the European Economic Area (the EU plus Norway, Iceland and Liechtenstein). Keeping tabs on people in Belgium’s movements via their identity cards is not practically possible. The Federal Interior Ministry says “You can’t just remotely read data from the chip and so you also would not be able to follow an individual remotely via the RF chip contained on their e-ID”.
Nevertheless, the privacy concerns regarding RFID chips are not completely unfounded. This is evident in advice issued by the Data Protection Authority in 2019. The authority expressed concerns about the long-term robustness of the encryption system used.
But can a microwave oven really damage you e-ID?
Yes. Exposing your e-ID card to the electro-magnetic waves generated inside a microwave oven can irreparably damage both the RFID chip and render the contact chip illegible. However, according to the conditions of a Royal Decree a damaged e-ID card is considered to be no longer valid and must be replaced at the holder’s expense.