Security Chips in Cards Carry Risks

With little thought, many Californians carry wafer-thin cards containing a 15-cent silicon chip that enable them to zip through toll booths, enter parking garages and access the office.

Called radio frequency identification, RFID technology is touted for its convenience and, more importantly, its security value at buildings, airports and borders.

But some say it comes at a price. Privacy rights advocates see a chilling side, warning that advances could offer new opportunities for identity thieves, furnish clues to stalkers and hand government another tool to spy on law-abiding citizens.

"Both sides are overplaying their hand," said Jim Harper, who monitors the issue for the Cato Institute, a libertarian think tank.

"The industry is trying to sell RFID as the hammer and every problem is the nail," he said. "The other side sees that and reacts with talk of banning RFID."

The chip is found in wallet-sized cards and tags attached to products for inventory control. A tiny wireless antenna transmits information, usually just an identifying number, to special readers. The technology can be used to authorize access, subtract payments, track sales or confirm the identity of a passenger preparing to board a plane.

The federal Department of Homeland Security, in a push to better verify identities, has mulled requiring RFIDs in driver's licenses but has ruled it out for now.

Clashes over the growing reach of RFID into everyday life have escalated across the country. Groups that typically are adversaries, such as the Gun Owners of California and the American Civil Liberties Union, urge legal constraints. Powerful forces, such as bankers and retailers, have lined up against restrictions.

In California, lawmakers in the coming weeks are expected to act on legislation seeking to restrict the government's use of the technology. If successful, they would be the first laws of their kind in the nation, said state Sen. Joe Simitian, a Palo Alto Democrat carrying five RFID-related measures.

"RFID has a million good uses. Tracking cattle, tracking soup is fine," Simitian said. "When you want to track California citizens, that's where it goes wrong."

His legislation would require the state, schools and other public agencies to impose special security measures before using the chip in items such as driver's licenses, health cards and school identification. The cards should be encrypted and armed with codes that only authorized readers can pick up, Simitian said.

The precautions can be met technologically but the cost of RFID will likely increase, various officials say.

Using these smart cards in the consumer product supply chain is relatively noncontroversial. But many people cringe at the idea of government and business knowing even more about individuals.

"The loudest debate is around privacy and security," said Michael Liard, a researcher who specializes in the technology for Boston-based ABI.

The RFID industry, now approaching $4 billion a year in sales, is expected to grow at a 20 percent annual clip, Liard said.

Backers of the technology note that security features are readily available to keep snooping and stealing to a minimum. They also stress its practical uses and convenience. For example, new credit cards use the technology to register inexpensive transactions without requiring a signature.

"Think bar codes that can talk," industry literature says.

Critics say that description is too simplistic. The technology has the potential to collect and store much more information than bar codes. This could expose the public to danger, infringe on privacy, and signal a retreat from the basic liberty to come and go as we please, they say. Scientific American magazine branded the use "human inventory control."

"If people buy into it without thinking, we've lost something very important in the American psyche," said Michael Ostrolenk, national director of the Liberty Coalition, an umbrella for civil liberties advocacy groups from People for the American Way to the Rutherford Institute.

"We have an ingrained dislike for the police state - the Soviet Union 'show me your papers' state," Ostrolenk said.

Industry officials say critics exaggerate the threat and understate the value of RFID.

"They make decisions based on not having the facts on what the technology can and cannot do," said Wolf Bielas, chief executive officer of RSI ID Technologies based in Chula Vista.

Joerg Borchert, a vice president of Infineon Technologies, said legislators are aiming at the wrong target. Instead, penalties for illegal use of stolen information should be more severe, he said.

"We should ban bad behavior - not the technology," Borchert said.

A crackdown could scare away investment and stifle innovation, Bielas and Borchert said.

"Technology is constantly evolving. Stopping technology or excluding certain technology can be counterproductive," Borchert said.

Asked Bielas: "When you kill it, what are you killing?"

Among the possibilities: Under-the-skin chips that can inform emergency medics of allergic reactions or other health problems even when the patient is unconscious. Refrigerators that could be programmed to read labels to ensure that milk, eggs and meat are still fresh.

"There's a lot of innovation left," said Alan Melling, Motorola's product management director.

That's exactly what has some so worried.

"We're talking about a technology that will only get smarter, smaller and cheaper for those who want to steal our information," Simitian said.

Critics say RFID data can be obtained by lifting the identifying number literally out of someone's pocket with a remote scanner from a couple of feet away. Data bases could be accessed to match the number with other personal information. In one experiment, access cards of several legislative employees were remotely read in elevators and in hallways and cloned, providing the "thief" with access to private, secured areas.

"It sounds like science fiction, but it's quite doable," said Lee Tien, an attorney with the Electronic Frontier Foundation, an advocate for privacy rights in the digital world. "It's not paranoia if the threat is real."

Bielas disputed the ease of high-tech thievery, saying most cards cannot be read from much of a distance. "You have a better chance to read my credit card with very good eyes," he said.

Borchert pointed out that RFID cards and tags and the necessary databases can be shielded from prying. It would take powerful, expensive readers and familiarity with special databases to have even a remote opportunity to obtain private information, he said.

Examples are rare, but there are cases of theft and human tracking. Spanish police suspect thieves used RFID readers to lift the keyless access code and steal soccer star David Beckham's luxury BMW. Toll- road information has been subpoenaed in divorce cases to document someone's movements. A small country school near Sacramento monitored elementary students without parental approval until a mother blew the whistle.

"A young girl is an easy mark for predators," said Michele Tatro, whose daughter came home one day wearing a school-mandated identification tag. "They were trying to force us to have an electronic beacon." School administrators later backpedaled. But Tatro, fearing that using RFID in school identification cards could expose children to harm, continues to press her case in support of restraining its use in government-issued documents.

Another argument is offered by Mary Wiberg, executive director of the California Commission on the Status of Women, a state agency. A tech- savvy stalker could track habits of an intended victim by lifting data used to pass toll booths, park and enter buildings, she said.

"Thousands of women and children are the victims of crimes . . . RFID technology would make illegal surveillance easier," Wiberg said.

Gov. Arnold Schwarzenegger has sided with industry in the past but is noncommittal toward Simitian's measures.

The Republican governor vetoed a bill limiting RFID last year, calling it "premature" and voicing concern that the measure could "unduly burden the numerous new applications" of the technology.

Simitian calls his goals for tighter security "common sense."

"Why do we have locks on our doors? Because we have something of value inside," he said.

-------------------------------------------

formatting link
An internationally oriented online platform for RFID companies and end users

Reply to
RFIDabc
Loading thread data ...

ElectronDepot website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.