critical time in the arena of consumer privacy

[Pat McCotter]

The sheep don't need to use it. "Let their chains rest lightly" ya know.

Here is an article I found talking about deactivation.

IS RFID A DANGER?
As RFID is slowly becoming an accepted norm for companies fighting counterfeit and improving logistics, Lukas Grunwald, Boris Wolf and Nicholas Walker of DN Systems, warn that maybe not enough attention has been paid to the risks it poses.

Applications based on RFID technology are becoming more and more important. RFID is already deployed in access-control systems for authentication, and to unlock a door or deactivate an anti-theft device in a car. Use in the retail industry is in the initial phases of wide deployment.

At present, there are only a few markets where RFID is used extensively. Some of the most common applications are at the point of sale: for self-checkout systems, intelligent shelf management, misplaced or perishable goods, receipt-less exchange, efficient warranty claim handling and many more. Several governments are considering integration of RFID chips into personal identification cards.

All RFID systems transact data and identity information by radio transmission. The individual implementations of RFID technology, however, have little else in common.

Some RFID systems include their own processing logic directly on the chip. These chips usually require a battery to ensure a consistent power supply to the logic chip. In contrast, the more common and less expensive type of RFID system is passive and draws power from the radio frequency energy emitted by an RFID reader within range.

This simple, passive type of chip cannot execute code. Instead, it can only transmit its serial number or ID code. Some chips additionally contain non-volatile RAM storage (NVRAM), allowing for persistent storage of data. These passive NVRAM chips are commonly used in the retail industry.

RFID chips can be accessed from a distance as well. This makes them useful in manufacturing as well as in the supply chain and logistics. Goods can be identified and traced from their origin to the customer and beyond.

This is one of the core differences between RFID, and EAN numbers and bar codes. Because of limited information capacity, EAN numbers and bar codes can at best be used to identify types or groups of goods but not to identify each manufactured unit. It is the significant increase in storage capacity that makes new applications possible with RFID: a smart fridge recognising expired food or a retail store offering receipt-less exchange of items.

Vendors are experimenting with RFID tags in a number of markets. They are attaching smart labels to consumer goods. Thanks to the standardisation efforts by EPC Global ,one can expect these smart labels to replace current EAN number and bar code solutions in the long run. RFID tags are assigned different radio frequencies depending on their application. Smart labels are usually of type ISO15693 or ISO14443A and operate in the 13.56MHz frequency band, while tags used for access control and identifying animals operate at 156KHz.

A risky technology
To convert to high-capacity RFID tags from classic tagging based on bar codes or block matrix codes is a tempting solution to many problems. It might be possible simply to exchange reader devices and keep the back-end application with few adjustments. The same software could process the numbers coming from the RFID tags where before it processed the numbers read from bar codes. However, such temptation does not take into account the risks of RFID. Using RFID in the supply chain introduces risks for the vendor as well as for the customer. These risks must be evaluated and then minimised or eliminated by organisational or technical measures.

Technical problems
Initial testing of bulk-reading found the process to be error-prone. Ideally a palette would arrive at a warehouse, and all products on the palette would be recognised immediately on arrival. In practice, however, only an average of approximately 70 per cent of RFID tags are properly recognised during a bulk read.

That said, there is no reliability problem when reading a queue of tags one at time. There are additional problems when tags are attached to metal foil or wrapped around products containing liquids because of radio shielding and reflection effects. The latency of the reading process is also important. Tags must remain in the radio field of the reader until the reading process is complete.

Privacy problems
Smart labels attached to retail products may be read at any time, even after purchase. It is thus quite possible to use them to identify or track a person. When tags are invisibly integrated into a product and remain physically and electrically intact after the purchase, this possibility of abuse is quite real and warrants consideration.

For example, Smart Labels are often inserted or even woven into the fabric of clothing. Because RFID tags have no read-protection whatsoever, somebody wearing a tagged suit could easily be identified - or re-identified - by reading the unique serial number of the tag.

This scenario is quite uncomfortable: one cannot know when and whether tags are being read. Smart labels contain a segmented EEPROM memory. The EEPROM memory is divided into the administrative data field and the user data field. The administrative data field is read-only and contains a globally unique serial number.

The user data field is writable and can potentially store information about the product, information about the purchase (such as the date, purchase price and other items purchased), or any other information. The serial number of the tag can be used as a unique key for recalling a record from a central database.

For security reasons, or because of the limited storage capacity of the tag's memory, information can be stored on a database server in a record keyed with the unique serial number of the tag. This could be used to supply the customer with elaborate background information about specific products or to supply the retailer with elaborate information about the customer.

If the tag in a suit only contains the ID number of the suit itself - if the user data field is empty or unused - with all customer and product information stored in a database system at the point of sale, then there is no direct link between the customer and the serial number.

However, if the person purchasing the suit carries an RFID member card, it would be possible to read the consumer's personal information from the card and to link the suit with that personal information in a database. A competitor familiar with another's data structures could collect information about new, old or unfaithful customers.

For good reason, privacy activists ask for ways to protect smart labels, but the ISO15XXX standards do not address issues of privacy. While it is possible to define tags as read-only, doing so renders it impossible to erase the write-protected areas.

In Germany, the Metro corporation introduced an RFID deactivator in response to protests from privacy activists and associations. The deactivator is designed to erase the content of RFID tags. For this to work the user data field must be kept fully writable; this introduces further risks for Metro as well as for the customer.

The effectiveness of the deactivator is also questionable because the globally unique serial number in the administrative data field is read-only by default and hence can still be used as long as the RFID tag remains functional. Even after the deactivator erases the tag it remains possible to use tools such as RF-Dump (developed as an auditing tool for RFID integration projects and for use in penetration testing) to modify the user data field arbitrarily.

The company RSA Security Inc has developed the Blocker Tag (by Dr Ari Jules and others), which it claims allows one to manage selectively which readers might access one's RFID tags. Initially, the Blocker Tag was intended to operate by broadcasting an interfering cover signal that would trigger the anti-collision mechanism of the reader and prevent any read or write transactions from succeeding - unless the Blocker Tag had been deactivated previously by an appropriate signal from the reader.

With this, RSA-Security would have delivered an effective RFID denial-of-service tool to your door: one with which smart labels could be nullified and could paralyse entire supply chains.

At present, RSA suggests soft-blocking instead. With this solution, a second RFID label signals to the reader that it should not read the tag. Alternatively, the same result can be achieved by setting a standardised bit directly in the label.

However, this is an unrealistic solution borne of marketing hype; the solution opens new security holes and does nothing to increase the consumer's privacy. RSA's solution is based on an expectation of compliance with their conventions; it does nothing to prevent a person with bad intentions and their own RFID transceiver from reading from or writing to any RFID tag.

Storing more information on an RFID tag than only a read-only EPC is not an option for retail shops because of the overwhelming risks involved. It remains to be seen whether RFID-enabled products such as smart household appliances will be the main applications for this technology.

As long as the industry is reluctant to provide labels with a complete and effective deactivation feature, RFID tags must be considered a risk to privacy. Consumers must be aware that they will carry readable and writable memory without their consent.

First published 6 September 2005

[ravelkinbow]

The effectiveness of the deactivator is also questionable because the globally unique serial number in the administrative data field is read-only by default and hence can still be used as long as the RFID tag remains functional. Even after the deactivator erases the tag it remains possible to use tools such as RF-Dump (developed as an auditing tool for RFID integration projects and for use in penetration testing) to modify the user data field arbitrarily.

As long as the industry is reluctant to provide labels with a complete and effective deactivation feature, RFID tags must be considered a risk to privacy. Consumers must be aware that they will carry readable and writable memory without their consent.

This is why this bill is important...even with deactivators the RFID can still function!

[Pat McCotter]

The only good activator is one that disables the antenna as this also powers the chip.

[tracysaboe]

This is why this bill is important...even with deactivators the RFID can still function!

You honestly think a LAW is going to solve this problem.

How naive.

<Shakes head>

Tracy

[Lloyd Danforth]

The only good activator is one that disables the antenna as this also powers the chip.

Ya mean like a fire?

[Pat McCotter]

The only good activator is one that disables the antenna as this also powers the chip.

Ya mean like a fire?

No, no, no, no! I'm still wearing the clothes! Please don't deactivate the chips, yet!

[Bald Eagle]

The ACLU has a good demonstration of how invasive of our privacy a national ID coupled with data mining can be.

http://www.aclu.org/pizza/images/screen.swf

I can't get it to play locally after I download it - I wanted to make it into a screensaver.

[NH Katherine]

Hi, all:

Sorry to be coming so late to this thread. Let me start by saying that I fully support this legislation.

CASPIAN, the 12,000 member free-market consumer privacy organization I founded in 1999, has never advocated any other legislation in response to any consumer privacy threat in its 7-year history. I believe that companies should be free to engage in whatever practices they choose. We consumers will respond in turn, causing business to adapt to better meet our needs and compete for our dollars. As it should be.

However, without adequate information, we cannot act in our own interest in the market. Given the ease with which RFID devices can be hidden in our belongings, it is crucial that we have a way to know of their presence if the market is to operate effectively around this issue.

Here is how we state the issue on the "About Us" FAQ on our website:



Q. The term "free market activism" has been used to describe your work. Can you say more?

A. CASPIAN operates under free market, Libertarian principles. We believe that a healthy free market depends on consumers having access to information that impacts them so they can work to ensure that their best interests are met in the marketplace. When consumers are not given pertinent facts, they get saddled with things like loyalty cards, CRM, retail surveillance, unbridled RFID usage, and the thousands of other offenses to their dignity, privacy, and economic well-being that have sprung up in recent years.

It is our hope to re-empower consumers after decades of apathy to feel confident saying things to business like "we prohibit" and "you must" -- since that is consumers' appropriate role in the free market equation. Consumers have too long relied on government to serve this function. We believe it is time for them to act in their own best interest.

Businesses can chose to respond to these demands or not, but the market will punish those who fail to pay attention to consumer concerns.


Q. Where does CASPIAN stand on legislation?

A. In general, we are not big fans of legislation as a way to solve consumer privacy problems -- with one exception. It is appropriate for legislation to protect consumers by preventing fraud and misrepresentation. For that reason, CASPIAN has developed sample federal legislation titled the "RFID Right to Know Act of 2003" [overview] that would require labeling on consumer items containing RFID tags.

We believe that, for example, selling a pair of shoes that doubles as a tracking device without telling consumers about the RFID device it contains is essentially a form of fraud. When a shopper buys a pair of shoes, she has a reasonable expectation that she is getting shoes -- not something else. Once mandatory labeling is in place, if people chose to buy shoes that can track them, that should be their free choice. But consumers must be informed of what that choice means.

Our sample legislation was authored for CASPIAN by Zoe Davidson of Boston University in the spring of 2003. It has since served as a model for lawmakers in several states to draft their own state-level RFID labeling legislation.


Q. Does CASPIAN want RFID banned?

A. No. We have never called for legislation to ban either RFID tags or supermarket loyalty cards. We do believe, however, that these technologies pose serious risks to consumers, and we have called on the world's shoppers to reject them. CASPIAN hopes to see both technologies ultimately fail in the marketplace as a result of consumer opinion.

In the long run, outright market failure would offer more effective consumer protections than temporary legislative band-aids. (What the legislature grants, the legislature can easily take away, limiting the field of consumer espionage to itself.)


Source: http://www.spychips.com/about_us.html

I hope this helps clarify our position, and explains why we have supported this bill. We call on other fredom-loving people of New Hampshire to do likewise.

- Katherine Albrecht

[NH Katherine]

If you have not already done so, I urge you to read the book I have co-authored on the topic of RFID. "Spychips, How Major Corporations and Government Plan to track your Every Move with RFID" details, in companies' own words, how they intend to hide RFID in our belongings and use them to spy on us.

Here is something I wrote recently that may help people understand our concerns about RFID:

Our key concern with RFID is the ease with which RFID tags can be hidden
and used to track individuals' movements and identify their belongings.
RFID tags can be (and have been) slipped between the layers of
cardboard, sewn into the seams of clothing, and heat sealed into molded
plastic. Because EPC tags contain unique ID numbers, the threat model is
that these ID numbers could be recorded in a database and linked with
the individuals purchasing the items at the point of sale. Later, the
presence of one of these tags anywhere near a reader device in the
environment would be a fair indicator of who was passing by.

Such reader devices can be hidden under floor tiles, woven into carpets,
embedded in walls and placed invisibly into doorways to interrogate the
tags people were wearing or carrying as they pass within range. This
could reveal not only the likely identity of an individual, but it would
allow a form of "virtual frisk" in which an individual's clothing and
possessions could be silently scanned and inventoried without his or her
consent.

In our books, "Spychips" and "The Spychips Threat," my co-author Liz
McIntyre and I include several hundred footnotes citing source materials
directly from IBM, Philips, NCR, Gillette, Procter & Gamble, Accenture,
Intel and many other companies. The documents we cite describe in the
companies' own words how they intend to use RFID to keep close tabs on
individual consumers -- to follow them around stores, peek inside their
bags, and spam them with invasive personalized advertising.

Many of these plans are quite disturbing, such as IBM's "person tracking
unit," described in their patent titled "Identification and Tracking of
Persons Using RFID Tagged Objects."

You can find the patent online here:
http://appft1.uspto.gov/netacgi/nph-Parser?Sect1=PTO2&Sect2=HITOFF&p=1&u=%2Fnetahtml%2FPTO%2Fsearch-bool.html&r=1&f=G&l=50&co1=AND&d=PG01&s1=20020165758.PGNR.&OS=DN/20020165758&RS=DN/20020165758

IBM describes how consumers can be tracked and identified through
RFID-tagged items they own, wear, and carry. IBM suggests placing
"person tracking units" to scan people's RFID tags in sports arenas,
theaters, libraries, museums, and even public restrooms to identify
unsuspecting members of the general public and spy on their belongings.
They suggest this information would be of value both to marketers and
government agents.

Some companies, like Philips, P&G, and Intel would like the scans to
extend into your home -- so they can keep an eye on the contents of your
refrigerator, medicine cabinet, or basement workshop. (We quote them in
the books, as well.) Bell South, parent company of Cingular wireless,
has even patented a way to scan your garbage at the dump in order to
keep closer tabs on your household habits. (That one is available as a
sworn document filed with the United States Patent and Trademark
Office.)

All of this and more is meticulously detailed in "Spychips" and "The
Spychips Threat" with extensive links to original source materials. My
co-author and I have spent the last four years researching this topic.
We have combed nearly 30,000 documents, including patent filings,
corporate white papers, promotional documents, technical and engineering
specs, conference proceedings, and much more. We are both trained
researchers -- I am completing my doctorate at Harvard University this
spring, and Liz spent years working as a high-level federal bank
examiner.

The plans we have uncovered and disclose in Spychips are extraordinarily
disturbing. I would be inclined to doubt them myself had I not seen the
extensive documentation with my own eyes. That is precisely why my
co-author and I felt it was so important to expose these plans by
writing the books. The research in the books is impeccable, and proves
beyond a doubt that major corporations and the government look forward
to harnessing the extraordinary potential of RFID to track and monitor
the public.

While there are many potentially beneficial uses for RFID, it is
important to recognize that there are also many bad uses for the
technology.

Consumer have a right to know when items they purchase -- and thus obtain ownership rights over -- have been embedded with this technology.

In freedom,
Katherine Albrecht

[NH Katherine]

Further clarification of our position on legislation

This is an excerpt from the "Pull the Plug" chapter of Spychips (pp. 222-225):

• Boycotts are fine and well, but what about the government? Shouldn?t they pass laws to protect us from RFID privacy invasion?
  
  In today's legislation-heavy climate, people immediately look to the government to protect them from marketplace threats. But there are two problems with asking lawmakers to regulate RFID. First, there is the lack of political will to do it, as we pointed out in Chapter 15. Corporate lobbyists have already begun whispering into politicians' ears how much more profitable it will be for them to "protect" RFID than to regulate it. But even if it we could get lawmakers to control RFID through legislation, it would be a bad idea. The reason goes straight to the heart of the new consumer movement: If we're going to fix this mess, we'd better start wielding power ourselves.
  
  Relying on the government to preserve our freedom and privacy is like asking a troop of foxes to preserve our hens. It's simply not in their nature to do it. While the people will always seek freedom and privacy, Government is the natural enemy of these aims ? a fact the founding fathers of our nation understood well when they crafted ways to limit the government's power.
  
  Begging the government, hat in hand, to solve our privacy problems for us is not only humiliating and ineffectual, but it turns us into a bunch of weak-willed sycophants, too cowed and domesticated to do anything for ourselves. We have to stop petitioning the corridors of power on bended knee, asking favors they are unlikely to grant, and instead ourselves become a powerful force to be reckoned with. This is how people throughout history have overthrown tyranny and regained their liberty -- not by asking the usurpers nicely for their rights, but by standing up and claiming them. 
  
  We believe the only appropriate role for RFID legislation is to require that companies tell us whether or not products contain RFID tags so we can make our own informed decisions about whether or not to buy them.
  
  Since spychips can be so easily hidden, it's possible that even the savviest RFID opponent could accidentally buy a product or clothing item containing one. To prevent this, we have developed model legislation that would require items containing RFID to be clearly labeled. This legislation, The RFID Right to Know Act, is available at the Spychips website.

I urge everyone commenting on RFID in this thread to please read the book. (I will loan you a copy if you cannot afford to buy it.) It is every bit a libertarian, free-market tome. In fact, as evidence of our free-market emphasis, I should point out that Spychips was the winner of Laissez Faire's Lysander Spooner Award for Advancing the Literature of Liberty.

Even Laissez Faire agrees that we should be told when RFID tags have been hidden in our belongings. In their review of our book, they write:

• To fend off the nightmarish future being blueprinted right now, the authors recommend boycotts, paying cash, deactivating or removing the chips from products you have no choice but to buy, and spreading the word. They also say vendors should be required to at least tell consumers when the potato chips include spychips. Uh, yes. 
  
  Source: http://www.lfb.com/index.php?stocknumber=PV9017

You can read the first chapter on Laissez Faire's website here:
http://www.lfb.org/index.php?template=spychipsexcerpt.html&stocknumber=PV9017

- Katherine Albrecht

[KBCraig]

Here's some information on the farming/ranching equivalent of CASPIAN. It seems there are efforts to mandate that all farm animals be chipped and tracked.

http://nonais.org/

Katherine, I noticed the email address you list here. Are your initials KMA, or does that stand for Kiss My... Aspirin bottle?

My father was a railroad telegraph operator. They used lots of shorthand and abbreviations. The typical response to bad news was the abbreviated version of "keep me advised", also standing for "kiss my ass". 

Kevin

[KBCraig]

Here's a horror story from Britain regarding animal tracking:

http://www.fwi.co.uk/Articles/2006/03/06/93014/Farmer+charged+over+lost+ear-tag.html

[NH Katherine]

PLEASE, PLEASE contact the Senate on HB 203

After months of effort on Joel's part and mine, the RFID labeling bill is on the verge of being killed by lobbyists. We URGENTLY need as many people as possible to please contact the senators on the Public and Minicipal Affairs Committee and ask them to recommend passage of HB 203, the RFID labeling bill.

Tell them you believe New Hampshire consumers have the right to know when items they buy have an RFID tag in them. The senators need an equal amount of input from consumers as they've gotten from lobbyists if they are to stand strong against industry pressure.

        Senator Sheila Roberge (pronounced "ROBE-erge")
        Bedford, NH   
        Phone: (603)472-8391
        email: N/A
       
        Senator Margaret W. Hassan (pronounced "HASS-en")
        Exeter, NH 
        Phone: (603)772-4187
        email: maggie.hassan@leg.state.nh.us
       
        Senator John S. Barnes Jr.
        Raymond, NH   
        Phone: (603)895-9352
        email: jack.barnes@leg.state.nh.us
       
        Senator Joseph D. Kenney
        Union, NH 
        Phone: (603)473-2569
        email: joseph.kenney@leg.state.nh.us
       
        Senator Andre' Martel (pronounced "mar-TELL")
        Manchester, NH 
        Phone: (603)622-8411
        email: andre.martel@leg.state.nh.us
       
        Senator Peter H. Burling
        Cornish, NH   
        Phone: (603)675-6255
        email: peter.burling@leg.state.nh.us

If you would like to contact your own senator, as well, you can find his or her contact information here:
http://www.gencourt.state.nh.us/ns/whosmyleg/default.asp

It is acceptable to call NH lawmakers at home during reasonable hours. Otherwise, you reach them during the day or leave a message on their work phones.

Time is of the essence. The committee of six people listed above will make a recommendation about the bill, then send it on to the rest of the Senate for a vote. This is likely to happen within the next few days, if not sooner.

*beg*

Thanks.
Katherine

p.s. KMA are my initials, Craig, You're not the first to notice that I've got some pretty rebellious initials

[tracysaboe]

With all due respect Katherine

Libertarians should not be making the government bigger and more powerfull.
libertarians should not be giving government more authority to regulate how private businesses want to run their business.

You don't have a "RIGHT" to know anything, that you didn't already volentarily contract for. And as such stating that you do have such a RIGHT you're no different then liberals that believe you have a "right" to an MRI or a "right" to an Abortion.

You don't have a right to information regarding whether or not a private company decided to use RFIDs. And to use the government to force other people who don't care about such things to pay for this enforcement is wrong -- just as it's wrong to stick a gun to business owners heads and force them to reveal information.

It saddens me that libertarians think that the government can solve their problems. I mean really, if libertarians honestly believe that government is the solution here, what hope do we have that non-libertarians will start realizing government isn't the answer?

This isn't an argument steming from anarchy either. This doesn't fall into the purview of government protecting your person or property from asault. I'm sorry, it just doesn't. Now if you're worried that the government will try to trace these -- fine, pass a law to prohibit government from using RFID reading as a meathod of searching for information -- but honestly, the government doesn't follow it's own laws now? What makes you think even a law would help stop that.

The government will still use these things even if private businessees stop -- exempt politically connected businesses that allow the government to use their technology to spy will be exempt.  (Because, seriously. Every law that's ever passed always, by the time everything is said and done, exempts the politically connected.) And then you'll have a worse situation then you currently have now.

And before anybody gives me this nonsense about "When are you getting here to start doing things, Tracy." Let me remind you, I do do things, and I donate pretty heavily to NH libertarian groups. But at the very least -- I'm not making things worse, by advocating government empowering, private property infringing laws. (Yes, this law violates the private property of businesses. You're forcing them to do things to their personal property they wouldn't do notherwise.)

<shakes head.> 

Tracy

[Bald Eagle]

I have to agree.

When you give the government authority to prohibit something, you de facto approve the government's authority to control that issue regardless of it's stance.  Which means that although today they may prohibit it, since the precedent of their authority over the issue is set, tomorrow they may mandate it.