Tuesday, May 13, 2008

Information tags along everywhere you go - Critics worry about the security of RFID

Now this is the kind of reporting we need A LOT more of in this country. The Baltimore Sun's Liz F. Kay clearly was given a lot of time and newspaper space to really delve into the issue of the rapidly growing "world of RFID", and the myriad of privacy concerns associated with it.

Of course, there are many that see "conspiracy theorists" in anyone that doesn't necessarily share their view that every technological advancement is necessarily "good". The RFID debate has largely shaped up this way.

A common attack - utilized by those that worship at the alter of technological innovation -against those who view privacy as an inalienable right that's under an unprecedented assault goes something like this: "People that are worried about RFID oppose technological advancements (i.e. the "luddite" attack) and would rather just live in caves". Or, they "are conspiracy nuts that have watched too many episodes of the X-Files". Or in this case, that somehow we are against all uses of RFID, and don't recognize the numerous benefits and conveniences it offers (which just about everyone does).

Of course, these are ludicrous "Straw Men". If anyone takes the time to read the California bills that propose to regulate RFID use for instance, it becomes readily apparent that we're talking about basic, common sense precautions that incorporate the "better safe than sorry" mantra.

You know, the ones, like "let's make sure they're properly encrypted first", or the "let's ensure people have the right to "opt-in" before they can be monitored anywhere they go", or the "let's not start tracking children in school" idea. Do these really sound "anti-technology" or "conspiratorial"?

If you want to take a look at some of the current RFID bills CFC supports that are making their way through the legislature just click here, and check out SB 28, 29, 30, 31, and 388. Clearly there's nothing remotely "conspiratorial" about them. What's scary is that anyone would actually oppose them. I find it troubling that so many in our country seem so trusting of government and big business when it comes to allowing such invasions of our privacy through easy access to our personal information as well as location (in addition to identity theft).

Thankfully, in the case of this article, all angles are covered, leaving one with a much better understanding of the issue and the reasons why the privacy concerns surrounding RFID are valid, and fairly easily solvable.

The Baltimore Sun's Liz F. Kay reports:

The tiny silicon chips are embedded in credit cards, passports and other everyday items and can transmit data on where you go, what you buy and even who you are.

...

But as RFID technology spreads and grows cheaper, critics say the tags and the signals they emit are increasingly likely to be abused: by those who would spy on your movements, steal your identity or even target you in a terrorist attack.The concern has led to some paranoia - and Web sites full of bizarre advice on avoiding RFID snoops. But authorities are beginning to listen to RFID's serious critics.

The U.S. State Department, for example, incorporated metal shielding into the covers of new passports after critics demonstrated how information from the RFID tags embedded in the documents could be read clandestinely from a distance. Last year, California legislators enacted a law prohibiting employers from forcing their employees to implant RFID tags in their bodies.

...

But the real problem, critics say, is that RFID tracking is virtually invisible and undetectable by its subjects."A lot of this is done not only without the consumer's knowledge - it's beyond the grasp of most consumers how it works. Nontechnical people don't know what the risks are. They just want to buy things and have their privacy and credit card numbers protected," said Avi Rubin, a Johns Hopkins University computer science professor who worked with Massachusetts researchers to crack the encryption scheme of the ExxonMobil Speedpass in 2005.

...

Even vocal RFID critics say the problem hasn't reached a crisis level - which makes it hard to argue their case.Lee Tien, senior staff attorney for the San Francisco-based Electronic Frontier Foundation, said those who raise the alarm realize how it would have felt to warn the public about air pollution the day the Model T was introduced.

The EFF has opposed use of the technology on several fronts. And as a parent, Tien spoke against a proposal for an enhanced California driver's license that could broadcast the name, address, height and weight of drivers - such as his 16-year-old daughter.But he doesn't oppose the technology itself. "I would honestly have no problem using RFID devices if I knew I could control who was going to read them," Tien said.

...

Unlike a bar code, an RFID tag doesn't have to be visible for a sensor to detect it."You're making available over the airwaves something that's previously available only through line of sight," said Hopkins' Avi Rubin.

...

The distance at which an RFID tag can be read varies - from mere centimeters on no-swipe credit cards to hundreds of feet for tollbooth tags.For many applications, Tien said, all you have to do is "follow somebody into an elevator. You're close enough."

...

Retailers often use RFID to manage inventory and prevent theft. But critics say the tags aren't required after consumers leave the store with their merchandise - often unaware that the tags are still functional. The tags can be disabled, but most stores don't bother. On one hand, promoters say, retailers could keep RFID tags on clothing they've sold previously to identify regular customers as they enter a store and offer personalized service. On the other, critics say, an RFID tag embedded in a book might tell a snoop that a reader is carrying The Communist Manifesto or Catcher in the Rye in his backpack.

...

Critics note that it's relatively easy to conceal inexpensive readers - hand-held or smaller - that can pick up an RFID tag a foot or two away. They could create a trail of your movements - an almost Orwellian capability."We spend our lives going through doorways. We are constantly channeled through, well, channels," Tien said. "That's where you can be easily tracked."

Click here to read the article in its entirety.

No comments: