'Sloppily drafted' government paper fails to convince lawmakers data will be kept safe
DANNY LEEdanny.lee@scmp.com
PUBLISHED : Wednesday, 07 January, 2015, 4:34am
UPDATED : Wednesday, 07 January, 2015, 4:34am
John Lee says ID cards need to be upgraded. Photo: Felix Wong
Government plans to introduce more secure Hong Kong smart identity cards from 2018 have received a hostile reception.
Lawmakers on the Legislative Council panel questioned the security of the ID cards using radio-frequency identification (RFID), which can allow people - or hackers - to retrieve personal data and information from a distance.
Legal-sector lawmaker and Civic Party member Dennis Kwok sought reassurances that there could be no "misuse of the technology" and whether anyone with a suitable device could "easily" access personal data on the card.
Existing ID cards have just one layer of security, but it is expected the new design will have two-step security measures - with encryption on top of that.
John Lee Ka-chiu, the undersecretary for security, said: "This would not happen. We have different safeguards in our software including an encryption key."
He added the ID card chip will be made as small as possible and only readable from devices up to 2cm away.
IT lawmaker Charles Mok criticised the government for a "sloppily drafted" paper that was light on technical detail.
Lawmakers added they would be unable to verify government claims that RFID technology was safe if the specifications were not provided.
About HK$2.9 billion is expected to be spent on the programme to replace some 8.8 million cards by 2022, of which around HK$1.45 billion would be sought from Legco's Finance Committee.
Existing smart ID cards issued between 2003 and 2007 are due to exceed their serviceable lifespan of 10 years by 2017. Lee warned the panel that if no action was taken there would be "chaos".
"The existing smart ID has aged and we need to replace the system," he added. "This is a consideration of necessity. We have to face the reality."
However, security officials could not guarantee that ID cards wouldn't need replacing again in 10 years' time, with manufacturers unwilling to provide a warranty for any longer than that, potentially seeing billions spent on another upgrade.
The government says the new smart ID card will allow people to use automated e-channel immigration services four seconds quicker - down from the current 12 seconds today.
http://m.scmp.com/news/hong-kong/article/1675840/lawmakers-raise-security-doubts-using-rfid-technology-new-hong-kong
