In a previous Gibbsblog posting I discussed the Department of State’s mandate that passports be chipped with RFID tags. I just spotted an update to this on Slashdot that refers to a Wired article wherein they note that the powers that be responded to the criticism that US passports could be easily detected (though not decrypted — see my previous posting) so they came up with a solution …
The solution is:
“As a result, RFID passports will now include a thin radio shield in their covers, protecting the chips when the passports are closed. Although some have derided this as a tinfoil hat for passports, the fact is the measure will prevent the documents from being snooped when closed.”Brilliant … until the snooping technology improves which should take, oh, maybe a week.
But what really intrigued me is that even without being able to decrypt the passport chip’s contents the unique “signature” of the RFID chip is enough to make identiying individuals easy.
The signature of a particular RFID chip can be determined by the built-in packet collision avoidence system on each chip — it uses a unique serial number! To counter this the State Department mandates that the RFID chips must conform to ISO 14443A which allows for a random collision avoidence ID to be used but apparently there are no manufacturers producing such chips yet.
Even if the passport RFID chips are conformant to this specification you will be trackable anyway. The reason is simple: The intention of every manufacturer and large scale retailer is to rely on RFID tags to track product flow for any and every product they carry.
What this means is that the average person in a few years will be tagged by as many as a dozen RFID tags in their clothes and still more in their watches, cellphones, briefcases, books, notepads, PDAs and every other accessory they carry.
But wait, that’s not all! There will also be RFID chips in Starbuck’s coffee cups, the sandwiches they purchased that morning at the supermarket, and possibly even their newspaper.
Now just think of the consequences of this: You will be surrounded by a “cloud” of tags and scanners could easily log all of them and infer who you are from the various tags you carry even as they are rotated out and replaced by others over time. When someone picks up your newspaper or you buy a coffee for a friend those transfers will map your relationships and movements making the shape of your life transparent to anyone with access to the data and adequate processing power.
Whether the idea of this bothers you depends on whether you have something to hide and whether you consider privacy important. What can be done about it? I forsee a booming market in shielded bags, RFID blocking devices, and other products for defeating or confusing scanners.
Of course you won’t be able to completely opt out any more than you can participate in the US economy above tourist level without a Social Security Number. There will be occasions and places where the RFID tags for something you own or carry will be required to get service or gain access. The first time you reveal any relationship between yourself and an RFID tag will put you on the tracking map.
I’m afraid that the RFIDization of our culture is inevitable. How much it will affect us will not be a technology issue, it will be a political issue.
