Connect with us

Security Chips in Cards Carry Risks

Discussion in 'Electronic Design' started by RFIDabc, Aug 20, 2007.

Scroll to continue with content
  1. RFIDabc

    RFIDabc Guest

    With little thought, many Californians carry wafer-thin cards
    containing a 15-cent silicon chip that enable them to zip through toll
    booths, enter parking garages and access the office.

    Called radio frequency identification, RFID technology is touted for
    its convenience and, more importantly, its security value at
    buildings, airports and borders.

    But some say it comes at a price. Privacy rights advocates see a
    chilling side, warning that advances could offer new opportunities for
    identity thieves, furnish clues to stalkers and hand government
    another tool to spy on law-abiding citizens.

    "Both sides are overplaying their hand," said Jim Harper, who monitors
    the issue for the Cato Institute, a libertarian think tank.

    "The industry is trying to sell RFID as the hammer and every problem
    is the nail," he said. "The other side sees that and reacts with talk
    of banning RFID."

    The chip is found in wallet-sized cards and tags attached to products
    for inventory control. A tiny wireless antenna transmits information,
    usually just an identifying number, to special readers. The technology
    can be used to authorize access, subtract payments, track sales or
    confirm the identity of a passenger preparing to board a plane.

    The federal Department of Homeland Security, in a push to better
    verify identities, has mulled requiring RFIDs in driver's licenses but
    has ruled it out for now.

    Clashes over the growing reach of RFID into everyday life have
    escalated across the country. Groups that typically are adversaries,
    such as the Gun Owners of California and the American Civil Liberties
    Union, urge legal constraints. Powerful forces, such as bankers and
    retailers, have lined up against restrictions.

    In California, lawmakers in the coming weeks are expected to act on
    legislation seeking to restrict the government's use of the
    technology. If successful, they would be the first laws of their kind
    in the nation, said state Sen. Joe Simitian, a Palo Alto Democrat
    carrying five RFID-related measures.

    "RFID has a million good uses. Tracking cattle, tracking soup is
    fine," Simitian said. "When you want to track California citizens,
    that's where it goes wrong."

    His legislation would require the state, schools and other public
    agencies to impose special security measures before using the chip in
    items such as driver's licenses, health cards and school
    identification. The cards should be encrypted and armed with codes
    that only authorized readers can pick up, Simitian said.

    The precautions can be met technologically but the cost of RFID will
    likely increase, various officials say.

    Using these smart cards in the consumer product supply chain is
    relatively noncontroversial. But many people cringe at the idea of
    government and business knowing even more about individuals.

    "The loudest debate is around privacy and security," said Michael
    Liard, a researcher who specializes in the technology for Boston-based

    The RFID industry, now approaching $4 billion a year in sales, is
    expected to grow at a 20 percent annual clip, Liard said.

    Backers of the technology note that security features are readily
    available to keep snooping and stealing to a minimum. They also stress
    its practical uses and convenience. For example, new credit cards use
    the technology to register inexpensive transactions without requiring
    a signature.

    "Think bar codes that can talk," industry literature says.

    Critics say that description is too simplistic. The technology has the
    potential to collect and store much more information than bar codes.
    This could expose the public to danger, infringe on privacy, and
    signal a retreat from the basic liberty to come and go as we please,
    they say. Scientific American magazine branded the use "human
    inventory control."

    "If people buy into it without thinking, we've lost something very
    important in the American psyche," said Michael Ostrolenk, national
    director of the Liberty Coalition, an umbrella for civil liberties
    advocacy groups from People for the American Way to the Rutherford

    "We have an ingrained dislike for the police state - the Soviet Union
    'show me your papers' state," Ostrolenk said.

    Industry officials say critics exaggerate the threat and understate
    the value of RFID.

    "They make decisions based on not having the facts on what the
    technology can and cannot do," said Wolf Bielas, chief executive
    officer of RSI ID Technologies based in Chula Vista.

    Joerg Borchert, a vice president of Infineon Technologies, said
    legislators are aiming at the wrong target. Instead, penalties for
    illegal use of stolen information should be more severe, he said.

    "We should ban bad behavior - not the technology," Borchert said.

    A crackdown could scare away investment and stifle innovation, Bielas
    and Borchert said.

    "Technology is constantly evolving. Stopping technology or excluding
    certain technology can be counterproductive," Borchert said.

    Asked Bielas: "When you kill it, what are you killing?"

    Among the possibilities: Under-the-skin chips that can inform
    emergency medics of allergic reactions or other health problems even
    when the patient is unconscious. Refrigerators that could be
    programmed to read labels to ensure that milk, eggs and meat are still

    "There's a lot of innovation left," said Alan Melling, Motorola's
    product management director.

    That's exactly what has some so worried.

    "We're talking about a technology that will only get smarter, smaller
    and cheaper for those who want to steal our information," Simitian

    Critics say RFID data can be obtained by lifting the identifying
    number literally out of someone's pocket with a remote scanner from a
    couple of feet away. Data bases could be accessed to match the number
    with other personal information. In one experiment, access cards of
    several legislative employees were remotely read in elevators and in
    hallways and cloned, providing the "thief" with access to private,
    secured areas.

    "It sounds like science fiction, but it's quite doable," said Lee
    Tien, an attorney with the Electronic Frontier Foundation, an advocate
    for privacy rights in the digital world. "It's not paranoia if the
    threat is real."

    Bielas disputed the ease of high-tech thievery, saying most cards
    cannot be read from much of a distance. "You have a better chance to
    read my credit card with very good eyes," he said.

    Borchert pointed out that RFID cards and tags and the necessary
    databases can be shielded from prying. It would take powerful,
    expensive readers and familiarity with special databases to have even
    a remote opportunity to obtain private information, he said.

    Examples are rare, but there are cases of theft and human tracking.
    Spanish police suspect thieves used RFID readers to lift the keyless
    access code and steal soccer star David Beckham's luxury BMW. Toll-
    road information has been subpoenaed in divorce cases to document
    someone's movements. A small country school near Sacramento monitored
    elementary students without parental approval until a mother blew the

    "A young girl is an easy mark for predators," said Michele Tatro,
    whose daughter came home one day wearing a school-mandated
    identification tag. "They were trying to force us to have an
    electronic beacon." School administrators later backpedaled. But
    Tatro, fearing that using RFID in school identification cards could
    expose children to harm, continues to press her case in support of
    restraining its use in government-issued documents.

    Another argument is offered by Mary Wiberg, executive director of the
    California Commission on the Status of Women, a state agency. A tech-
    savvy stalker could track habits of an intended victim by lifting data
    used to pass toll booths, park and enter buildings, she said.

    "Thousands of women and children are the victims of crimes . . . RFID
    technology would make illegal surveillance easier," Wiberg said.

    Gov. Arnold Schwarzenegger has sided with industry in the past but is
    noncommittal toward Simitian's measures.

    The Republican governor vetoed a bill limiting RFID last year, calling
    it "premature" and voicing concern that the measure could "unduly
    burden the numerous new applications" of the technology.

    Simitian calls his goals for tighter security "common sense."

    "Why do we have locks on our doors? Because we have something of value
    inside," he said.
Ask a Question
Want to reply to this thread or ask your own question?
You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.
Electronics Point Logo
Continue to site
Quote of the day