E-pickpockets may target wallets

Could your wallet be giving away your secrets?

Your employee ID/building access card, your credit card, your gas purchasing cards and even digital driver's licenses being developed in some states may employ versions of radio frequency identification technology, or RFID, that toss out bits of personal data that are caught by receivers -- legal or not.

So, conceivably, a pickpocket with a laptop and an antenna could lift the digital contents of your wallet. This modern Artful Dodger would never reach his fingers under your jacket. He could be that guy with a backpack slouched on a bench in the airport, vacuuming up bits and bytes as crowds flow past.

The scenario has mainly been reenacted by researcher-hackers under simulated conditions. The makers and issuers of RFID cards insist the data are encrypted and safe. Yet some security watchdogs assert the need to cover, or shield, these cards when they aren't in use. A thin metalized nylon can do the trick, based on the classic Faraday cage design, to disrupt RFID communications.

Travel magazine ads tout metal-lined wallets, topping out at the $225 Italian leather Teju lizard embossed travel wallet.

"If I had an RFID that didn't have a cover, a driver's license, a credit card, a corporate ID card . . . . suddenly a (shielded) wallet isn't such a stupid idea," said Bruce Schneier, an author of books on security and chief technology officer of Santa Clara-based BT Counterpane, a network security company.

"RFID creates security and privacy risks," said Marc Rotenberg, president of the Electronic Privacy Information Center in Washington.

A couple of years ago, when the State Department announced the new style of passports, Rotenberg's group recommended that people wrap their passports in tinfoil. Instead, the State Department addressed concerns by embedding metallic shielding in the front and back covers of passport books.

MasterCard said consumers need not invest in shielded wallets. "All of our cards go through very strict security testing," MasterCard spokeswoman Erica Harvill said.

The data on the cards are encrypted using a system involving random, unique authentication codes that can be used only once, she said, and the signals travel a very short distance.

But if the specter of unauthorized leaks from your hip pocket keeps you awake at night, Geb Masterson, president of Kena Kai in Anaheim Hills, will sell you one of his DataSafe models. The shielding material is a thin "metalized nylon." His sales pitch: Hackers are only going to get better at data theft, so better safe than sorry.

"I have to carry a wallet anyway," he said. "I'd rather have it lined in this material that radio frequencies can't get through."