RFID Hysteria

by Bill Glover

Related link: http://news.bbc.co.uk/1/hi/technology/4721175.stm



There are real privacy and security considerations in the use of of RFID, but consider the following:

"It's a very scary technology," said Katherine Albrecht, a consumer rights analyst and founder of Caspian, a pressure group which opposes RFID.
"I would no longer be known as a living, breathing, spiritual person but become known as a single number that would be emanating from a chip in my flesh... essentially becoming a form of human inventory, rather than a human being."
...
"A criminal could scan you surreptitiously, then use that information to access other information about you, and potentially do some identity theft," she said.
"The other thing they could do is that, by scanning that number, it's actually quite a simple matter to capture the number and create your own chip with the same number in it.
"You could simply programme a different chip, put it inside an encapsulated device, and put it in your own arm - and at that point you could pose as the individual whose identity you have chosen to steal."
So to sum up Ms. Albrecht's objections:
  • RFID is Scary and will somehow effect her spirtually
  • RFID will associate her with a number
  • People can read her number
  • People can use her number
I wonder if Ms. Albrecht uses a credit card? It's much easier to do all of the things she describes with your credit card number. When was the last time she handed that credit card to a waiter who then walked off with it?

As for how the spiritual consequences of having an RFID tag differ from those of having a credit card, I can't comment except to answer some of the charges that this form of identification somehow matches bibical prophesies. One of the actual scriptures this argument refers to reads:

so that no one could buy or sell unless he had the mark, which is the name of the beast or the number of his name. Rev 13:17 (NIV)


But what about the following scripture?

A third angel followed them and said in a loud voice: "If anyone worships the beast and his image and receives his mark on the forehead or on the hand, Rev 14:9 (NIV)


This seems to describe a visible mark (otherwise why is it on the forehead or hand?) not an invisble chip inserted into the back of the arm or shoulder.

With that said, I should probably point out that I'm not exactly running out to have an RFID tag implanted in my arm. I do think there is merit in the argument that I should be able to turn the tag on and off or shield it in some way to disable it for privacy. Also, with such a fast changing technology I would be worried that any tag in the near future might become obsolete and need to be replaced. Also, Ms. Albrecht failed to mention the most obvious way of stealing the tag, either removing it (which might be thwarted by some sort of heat sensor in the tag itself), or kidnapping me and standing me close to the reader. In much the same way that more advanced alarm systems may have led to carjacking, an implanted ID could lead to "bodyjacking." The application described in the article, identifying victims of catastrophes, does seem like a suitable application for an embedded chip, but statistically only a tiny percentage of us are likely to die in that manner, and by definition we can't know which of us will be effected ahead of time. For now, I'll stick with an tag on a keychain.


What about you? Would you get "chipped?"


10 Comments

CamonZ
2005-07-28 20:42:46
that's bad
it's really a shame that some people think the way this lady does, i know RFID still has a long way to go until it is a secure technology for identification purposes, but still we might also consider all the benefits this technology could bring us, imagine predictive traffic analysis, if by instance there where sensors all over a city and cars had a tag; police would know how exactly a car accident happened, cars wouldn't be stolen that much, if they could be traced with a minimal error on their exact position (i know military gps already does this, but this would be so much a cheaper way of tracking cars) instead of the current method of triangulation
http://www.northsight.com/AVL.htm


i know this would help alot here in venezuela
and still not taking into account the obvious benefits, wich are already being used by companies like Gillette wich invested 50mil$ in RFID for an easier method of keeping inventary in their warehouses, and it's really sad that the people at EFF are willing to use this lady as leverage for their fight for electronic privacy (this actually came from an interview from wired news with katherine albrecht)


http://www.wired.com/news/privacy/0,1848,68133,00.html


wich i know privacy is a realy subject we should all be concerned about, but still i still think RFID is a good technology wich could make our lives better


CamonZ

jwenting
2005-07-28 23:22:48
makes some sense
The difference between a swipe card (like a credit card of ATM card) and an RFID chip is that the latter can be read out remotely and unnoticed.

Depending on the power of the chip and the reader, that distance can be substantial (though more than a few meters is likely useless because it gets progressively harder to single out the one signal you're interested in among all the others).

When/If it is decided to fit everyone with a chip and link that up to a central database with personal information, it'll indeed be only a matter of time before people find ways to harvest that information for criminal purposes.
And where at the moment ID theft involved inciting the victim to hand over the information to the crook, leaving a trail which could be followed, the crook would in the future need only be in the general vicinity of his victim for a few seconds. Standing in line at the supermarket or riding the bus suddenly becomes a risky business...

RFID is already marketed as a great tool for stores to detect former customers who enter so they can flash them with advertising. Walk past a shoestore in the boots you bought there last year and you'll get an SMS (via the cellphone you registered on your customer card) telling you something like "old shoes? Special offers today for loyal customers!".

RFID chip implants are also already used to identify pets found on the street and reunite them with their owners. A central registry takes care of maintaining a list of owners.

Tests in several European countries are underway in which customers from clubs get an RFID chip implanted under the skin. Linked to their bankaccount it can be used for all payments at the club.

Some European countries are thinking of implanting chips to make identifying John Does easier. If everyone has a chip that links to a database with his/her name and address an emergency room doctor or coroner no longer has to do exhaustive searches of DNA or fingerprint databases (which often don't turn up anything if the person involved has never had contact with the police).

Combine all those scenarios and you get a chilling world in which every last detail about a person is contained in a chip (or rather retrievable from a central location with the information that chip provides) implanted in his body which can be read out without that person ever knowing it.

It'll take a while to get to that point, but it WILL get there.

And when it does people WILL find ways to abuse that information, whether criminals or repressive governments it hardly matters. All that matters is that your life will be under complete scrutiny and/or control.
jwenting
2005-07-28 23:27:49
makes some sense
P.S.

Turning the thing on or off is impossible. RFID chips are passive, sending out their signal only when queried with the correct signal.

That's their greatest strength, they don't need batteries or other things that can break down (no heat sensors either). The antenna is at the same time the power source, using the energy in the received signal to power the chip while it does its work.

This of course means the chip can stay dormant for years and will still work when triggered, a great bonus as it means you won't have to replace them periodically (as you would any powered device).
jwenting
2005-07-28 23:37:50
that's bad
Don't give the police any ideas about more easily tracking cars...

They're already planning to fit all cars with GPS systems and radio transmitters here, sending the car's exact location, direction of travel, and speed to a central computer every minute or so.

The purpose is officially to enable tracking of traffic jams and in the future road charges, but in reality the main purpose is to allow them to send out speeding tickets without ever having to patrol the roads. Your car gives them all the proof they need, and everything can be completely automated.

RFID can't be used for that as the range is too limited and it would mean installing detectors and associated transmitters every few meters all over the country. Tell people to install a GPS based system in their cars and you need only a few repeater antennas every hundred km or so, and the rest of the cost is born by the victims of your surveillance.

RFID, when used sensibly and cautiously, can indeed be a great system.
I'm thinking of tracking shipments or perishable goods for example. A chip on the box or pallet can contain far more information about the origins and route of travel than can a barcode (which is the current system of choice).

But don't turn me into another inventory item of the government, don't brand me with a number like the SS branded the victims of the concentration camps (as do other repressive governments the world over).
CamonZ
2005-07-29 01:18:50
that's bad
i know gps is not a bad choice, if you already have 3 satellites over the region so they can triangulate the signal (and only militar gps is about 10 feet error margin--to my knowledge ) , besides, at least over here, they say it's based on gps but the truth is they are using the CDMA network for triangulating the signal on within 3 cells, so it's not exactly accurate,
about the range of the devices, UHF RFID tags, can track objects moving as fast as 150MPH and at least 100 feet away, wich is not bad, for a passive element, actually i'm thinking of making my thesis on a car tracking network based on RFID,
not putting a active element on every corner but still getting a really good aproximation on the location of the vehicle,
i know that what the cops over there are planning to do sucks big time, i was giving it some thought today regarding the privacy issue, but theorically you shouldn't speed although everyone does it here, as well as skipping the traffic lights, :-)
i guess that people still want to be able to do bad things without others inmediately knowing, i guess it's our nature, still i'll put a good example, about a year and a half ago i was involved in a car accident when a guy who was in the middle channel of the street, suddenly steered to make a right turn, the cops over here did the report all wrong, and i was this close to not getting the insurance company to pay for the repair expenses, still i think that if such a system would be implemented it shouldn't be on the hands of the government, and come to think about it, it is already a lot of knowledge for a company to have :->,

and come to think about being just a number for our governments, we are and have been for a long time, over here is the ID Card, in the US is the Social Security Number, and the way things are going to be with the continuous developement of wireless networks and automatization of proccesses due to computers, someone will always know what you are doing, and who you are

P.S. i sincerily hope organized groups of spammers don't hack then into these databases and conduct massive scale attacks on ppl, on their wireless devices :-(
jwenting
2005-07-29 03:40:34
that's bad
Active RFID chips (I was limiting myself to passive chips as the main intent of the original article was on implanted chips in humans which of necessity will need to be passive) indeed have longer range and might be a viable alternative to GPS (or related tech) tracking in high density areas (they'd give higher precision for sure, offset by the larger number of receiving stations).

But it wouldn't have helped you in your accident.
For that the System would need to have (and store) a second by second position of every vehicle, a far larger datastream than the one planned for GPS based systems. This would increase the cost and complexity of the System even further.

Of course noone should speed but everyone does it. It's the last means of civil disobedience left ;) as well as being a bit of a sport.

In fact many people here at least have come to see the occasional speeding ticket as just another tax, they come on average once a year after all just like tax forms :)

SSN/SOFI (that's what it's called here) are tightly regulated as to what can be stored under them. Health and financial information (except insofar as it pertains to tax purposes, thus income figures) are about the only things that are legally tracked through them. And the use of that information is also tightly controlled. Except for taxation purposes (and applying for unemployment benefits etc.) they can't be used (at least legally, next time someone asks you for your SSN just refuse them as you are in no way obliged to give it except for tax purposes).
The systems envisioned to come into existence through tagging everyone with a chip OTOH will have no limits. Your financial info will be coupled to your bank account history, your criminal record (all those speeding and parking fines included), your health history (hmm, he went to the doc to get a CAT scan of his head, might have cancer so we should deny him that mortgage), even when and through which border crossing you leave and enter the country.

Link that to phone and internet records (police here have already given themselves the right to track all cellphone calls and internet traffic without needing a court order, link that to all that other info through the number of your chip...) and you have a police state the likes Orwell could only dream about.
Bill_Glover
2005-07-29 08:23:38
makes some sense
You make some good points, but it is possible to design a passive tag which can be disabled. EPC tags have a "kill code" for example which permanently disables the tag. My proposal is that in addition to the kill code, an embedded tag should have a temporary "disabled code" which can only be reactivated with your personal key. This reinforces the precedent that, "anything in my body belongs to me." Interestingly, many implants such as pacemakers today are not passive, but instead may use batteries which are either replaced through surgery or charged through the skin using an inductive coupling. For an ID tag, passive technology seems better for all of the reasons you describe, but more complex devices with health sensors etc. may be semi-passive which is to say the communications would be passive, but computation and sensors would be powered by a battery.
KenHansen
2005-07-29 14:04:40
makes some sense
A one-time disabled chip has some value, but you are suggesting/requesting that RFID chip makers create chips that have *logic*, and that they retain a *state*, so that when the chip is "energized" it can determine if it should relay it's information. These chips would be infinitely harder to implement. One of the reasons companies want to deploy RFID is the promise of low-cost chips, ideally pennies per chip. The chip you describe would be large, complex and expensive.


All the arguments against RFID assume that databases can be accessed and exploited - if that is the case, why couldn't a random number generator be used to get the information without having to bother with messy readers/antennas?


Do I want an RFID implant, no - because having an implant gives me no appreciable benefit. Is there a benefit down the line that might cause me to change my mind? Perhaps, but it would take an awful lot of benefit.

KenHansen
2005-07-29 14:13:14
RE: Tracking Shipments
RFID is used not for it's ability to contain large amounts of data - it holds just a few numbers, up to 128 bytes (in my exp., other chips may provide larger data areas) - it is used for the ability of the RFID tag to be "read" without making physical or visual contact with the "tag" (like you would with a barcode). The novel part is that you can rewrite the contents of some RFID chips to have different information at different times (think RFID in a library book, there is a fixed serial number that identifies the book, and a variable that indicates when the book is due to be returned to the library - that way, you could detect overdue books in a book bag without having to examine the contents).


Barcodes contain numbers, RFID tags contain numbers, barcodes can be as long as you want, RFID tags can be up to a certain length (varies by tag). Barcodes are write-once, RFID can be read-write.


A lot of people seem to confuse RFID with SMART cards, chips with logic and storage - RFID is just storage.

Bill_Glover
2005-07-29 15:44:17
Passive Tags Can Store State
The EPC Class I Gen2 UHF passive tags retain state now (passwords) and may optionally have user rewritable memory pages. Using the access password and adding one more bit for enable/disable wouldn't increase cost by much.


http://www.epcglobalinc.org/standards_technology/EPC_Tag%20Data%20Specification%201.1Rev%201.27.pdf