Although the controversy about RFID chips rages on, the concerns aren't just about lack of privacy or the fact that anybody can be tracked anywhere with them. As the following article on the new RFID chipped passports illustrates, the chips are extremely vulnerable to ID theft. The new RFID passports costing $45 can be scanned from 20 feet away, and unfortunately, the average computer geek can figure out how to make a scanning device for around $50 and disguise it. The more secure RFID passports will cost more, and can only be scanned from about 3 inches away.

Never-the-less, as the following articles illustrate, any guy or gal walking down the street with an RFID chipped drivers' license, ID card or passport could have their information scanned and stolen and never even know it until it's too late.

http://www.washingtonpost.com/wp-dyn/content/article/20...AR2007123101922.html

Electronic Passports Raise Privacy Issues

By Ellen Nakashima
Washington Post Staff Writer
Tuesday, January 1, 2008; Page A06

The federal government will soon offer passport cards equipped with electronic data chips to U.S. citizens who travel frequently between the United States and Canada, Mexico or the Caribbean. The cards can be read wirelessly from 20 feet, offering convenience to travelers but raising security and privacy concerns about the possibility of data being intercepted.

The goal of the passport card, an alternative to the traditional passport, is to reduce the wait at land and sea border checkpoints by using an electronic device that can simultaneously read multiple cards' radio frequency identification (RFID) signals from a distance, checking travelers against terrorist and criminal watchlists while they wait.

"As people are approaching a port of inspection, they can show the card to the reader, and by the time they get to the inspector, all the information will have been verified and they can be waved on through," said Ann Barrett, deputy assistant secretary of state for passport services, commenting on the final rule on passport cards published yesterday in the Federal Register.

The $45 card will be optional and cannot be used for air travel. Travelers can opt for a more secure, if more costly, e-passport that costs $97 and contains a radio frequency chip that can only be read at a distance of three inches. Privacy and security experts said the new passport cards that transmit information over longer distances are much less secure.

"The government is fundamentally weakening border security and privacy for passport holders in order to get people through the lines faster," said Ari Schwartz, deputy director of the Center for Democracy and Technology, which submitted comments in opposition to the proposed rule, along with 4,000 others, the vast majority in opposition.

The problem with the card, Schwartz said, is that it uses a standard that wasn't meant to track people. "It's not made as an identity document," he said. "The technology they're using was designed to track goods -- pallets of toilet paper at Wal-Mart," he said.


The government said that to protect the data against copying or theft, the chip will contain a unique identifying number linked to information in a secure government database but not to names, Social Security numbers or other personal information. It will also come with a protective sleeve to guard against hackers trying to skim data wirelessly, Barrett said.

The card is part of the Western Hemisphere Travel Initiative, aimed at strengthening border security while easing entry for citizens and legitimate visitors with standard identity documents.

Although the chip is passive and can be read only when a reader pings it, a reader with a strong battery can detect the chip's signal from as far as 40 feet away, Schwartz said. It can easily be cloned, posing the risk that a hacker could make a duplicate card to fool a border agent, he said.

Avi Rubin, a professor at Johns Hopkins University, said that two years ago, he duplicated an RFID chip in his "speedpass" used for buying gas, copied the information onto a laptop and, after extending a radio antenna from the laptop out the car door, was able to buy gas with the cloned RFID chip.

Randy Vanderhoof, executive director of the Smart Card Alliance, represents technology firms that make another kind of RFID chip, one that can only be read up close, and he is critical of the passport card's technology. It offers no way to check whether the card is valid or a duplicate, he said, so a hacker could alter the number on the chip using the same techniques used in cloning.

"Because there's no security in the numbering system, a person who obtains a passport card and is later placed on a watchlist could easily alter the number on the passport card to someone else's who's not on the watchlist," Vanderhoof said.

Last year, the Government Accountability Office reviewed technology similar to that used in the passport cards. The report found low read rates and said the technology should be used only to track goods, not to identify people.

The State Department hopes to begin issuing the cards in the spring. For more information, go to http://www.travel.state.gov.


And here is another article...

http://www.spychips.com/press-releases/flawed-credit-card-security.html

FOR IMMEDIATE RELEASE
October 23, 2006

CONSUMER WATCHDOGS DEMAND RECALL OF SPYCHIPPED CREDIT CARDS

CASPIAN Advises Consumers to Immediately Remove Cards from Wallets

Consumer watchdog group CASPIAN is demanding a recall of millions of RFID-equipped contactless credit cards in light of serious security flaws reported today in the New York Times. The paper reports that a team of security researchers has found that virtually every one of these cards tested is vulnerable to unauthorized charges and puts consumers at risk for identity theft.
Radio Frequency Identification (RFID) is a controversial technology that uses tiny microchips to transmit information at a distance. These RFID microchips have earned the nickname "spychips" because the data they contain can be read silently and invisibly by radio waves without an individual's knowledge or consent. The technology has long been the target of criticism by privacy and civil liberties groups.

"For these financial institutions to put RFID in credit cards, one of the most sensitive items we carry, is absolute lunacy," said Dr. Katherine Albrecht, founder and director of CASPIAN, a consumer group with over 12,000 members in 30 countries worldwide.

Researchers are showing how a thief could skim information from the cards right through purses, backpacks and wallets. This information includes the cardholder's name, credit card number, expiration date and other data that would be sufficient to make unauthorized purchases. They say the information could even be used to identify and track people, a scenario Albrecht and co-author Liz McIntyre lay out in their book, "Spychips: How Major Corporations and Government Plan to Track Your Every Purchase and Watch Your Every Move."

Despite earlier assurances by the issuing companies that the data contained in the credit cards would be secure, researchers found that the majority of cards they tested did not use encryption or protect the data in any way. The information on them was readily available to unauthorized parties using equipment that could be assembled for as little as $50, the researchers said.

"We cautioned companies against using item-level RFID, and they didn't heed us. Now the credit card industry is facing an unprecedented PR and financial disaster," says McIntyre, who is also a former bank examiner. She points to the astronomical cost to replace the cards, not to mention the potential financial losses, litigation expenses, and erosion of consumer trust.

Albrecht and McIntyre are calling on the industry to issue a public alert detailing the dangers of the cards they've issued, institute an active recall, and make safe versions without RFID available to concerned consumers.

"This recall has to be very clear and very directed since consumers may not know their cards contain RFID tags," says Albrecht. "The industry has repeatedly resisted calls to clearly label the cards. Rather, they've given the cards innocent-sounding names like 'Blink.'"

CASPIAN is advising consumers to immediately remove the credit cards from their wallets and call the 800 number on the back to insist on an RFID-free replacement card. The group is cautioning consumers not to mail the cards back or simply throw them away due to the risk of their personal information being skimmed.

Today's New York Times article by John Schwartz can be found here:

http://www.nytimes.com/2006/10/23/business/23card.html?ref=business

A research report detailing the findings can be found here:

http://www.nytimes.com/packages/pdf/business/20061023_CARD/techreport.pdf

I replied in the other thread and really don't have time to go through this one and examine all these links too. So if they are there, if you can, let me know if anyone is requiring me to have an RFID driver license, license plate, library card or underwear.

If it's all voluntary, then my advice is simply don't carry or wear one.

Wayne

Wayne, I don't think "you" are necessarely going to be "required", but that doesn't mean you are going to have a choice. If all manufactures decide to put in an RFID chip, your choice will be not to buy anything.

If your state decides to incorporate RFID chips in all state drivers' licences and or passports, your choice will be going without ID or a current drivers' license.

Not much of a choice, eh?

This is a relatively new technology. Somebody at the federal level seems to be pushing for it big time, and for all we know, that somebody could simply be a powerful lobby group representing the manufacturers of RFID chips.

On the other hand, the rather extreme positions of the military and Homeland Security heirarchy seem to be pushing for RFID, and the one thing I am convinced of is that my constitutional rights are evidently being reduced by people who advocate that our national safety and security are more important than our freedom.

At this point, I am not sure I agree with their concepts.

I am also extremely concerned because the Homeland Security site clearly indicates that "other non-government agencies" will have access to the info contained in the RFID chips.

What does this mean? Does it mean that now that it is so much harder for people to declare bankruptcy, your creditors as a "non-government agency" will be able to track people to the ends of the earth in order to make them pay up?

I'd like to get some real answers to these questions, wouldn't you?

Unfortunately, every time I've written to my Senators, Representitives or the White House asking for answers, I've only recieved a form letter back telling me that my letter "was important to them" (yadda yadda blah blah blah) and never heard another word back.

I've found "government as usual" very frustrating.

I am guessing the AG has also never read the last portion of the story "The Boy who Cried Wolf" either. Most people show it as a reason to not raise read flags, when really it was a lesson that not paying attention to the red flags raised, can cost you dearly (i.e., the townspeople being out food and clothing sources and the boys parents losing a child).

quote:

Originally posted by wd8izh:
I am guessing the AG has also never read the last portion of the story "The Boy who Cried Wolf" either. Most people show it as a reason to not raise read flags, when really it was a lesson that not paying attention to the red flags raised, can cost you dearly (i.e., the townspeople being out food and clothing sources and the boys parents losing a child).

Nope, Bill, I just don't panic at speculation about what some folk believe might happen. Show me actual signs that it is or has a strong likelyhood of hapening and I'll be right there next to you all.

Back to the example of NAIS, no one could show me any evidence that each of my chickens would have to be micro-chipped, yet everyone from individuals here to the Organic Consumers group loudly claimed it was most definitely so. All I asked was to be pointed to the proper documentation, but none was forthcoming.

By the way, folks here in the East using the RFID driven EZ Pass toll devices love them. Do they have the capability of being misused? Perhaps. Does that make the technology bad? Not in my estimation. There are few technologies used in our daily lives that don't carry that risk.

Wayne

Wayne, I am curious. Are the EZ pass toll devices you are talking about connected to sensitive identity factors, such as might be required in the issuance of drivers' lisences, passports or a national ID card? We don't have anything like EZ passes or even toll boothes in my state, so my curiosity is real. But from what I've read, I don't think the toll passes would personally cause me any concern either.

However I DO think walking down a sidewalk with an RFID chipped drivers' liscence or ID card in my purse or back pocket absolutely would cause me concern, because they would be too easy for anyone with a conterfeit scanner to read. If an ID theif got within three inches of the card, the info to date suggests that ID theives could scan it, and in a crowd, I'd probably never even know. If the RFID chip contained sensative identity information, I would be realistically concerned that the info on that chip would be too easy to rip-off. I would think standing in a check out line would be dangerous too.

If people can put together an under-the-table scanner for $47 and make it look like a cane or an umbrella, I don't personally think any of us would be safe.

But on the other hand, I could be recieving signals from the outer space greys that are coming to take over the world from Zeta Reticuli and Planet X who will biochip us all and impregnate me. I am obviously unprotected because I didn't put my tin foil hat on today...

The EZ Pass decvices mount near your car windshield and lets you slow down to about 5 MPH while passing through toll booths. I'm not sure if they would read it at 65 MPH but driving that fast through the booths would be frowned on.

I'm sure they are interconnected to some database that stores personal information, since like anything else, it has to let you pay for service and let you access your account online.

For Valentine's Day, I'm designing a nice line of red foil hats to complement the heart-shaped boxes of chocolates we find this time of year.

Wayne

Hmmmm. Red isn't my color; I'd prefer black leather, but I wouldn't pass on the chocolate; make mine dark...

The EZ Pass here in Texas doesn't have a toll booth and you don't have to slow down. You just drive and they send you a bill for any tolls.

I suppose if you are used to toll roads you would consider that a convenience.

But for somebody who lives in a state that has no toll roads yet, the whole thing sounds pretty grim. I have a problem with the concept of toll roads because, as I understand it, the tax that is placed on gasoline was supposed to pay for our roads, or that was its original intent. I know they've raised the gas tax several times that I can remember, so is somebody siphoning into that fund for something else? (After all, they siphon off of the Social Security fund.) It sure looks to me like road tolls are a bit of a double dip tax to consumers...

RFID EZpasses or not, is anybody looking at the books?

We have toll roads here in Southern California, and we have the option of having a FasTrack transponder on our windshield or stop and put coins in the receptacle.

Don't they want everyone in the U.S. to get some kind of fancy high tech driver's license?

--J--

The toll road here reads your license plate and bills the owner. You don't need any special tag. There is a toll tag you can purchase to place on your windshield so you can pre pay at a special rate.

Wayne, Just gotta add my 2 cents here. Many years ago the USDA came up with a volunteer program for people who raise animals. A friend of ours was asked if he would like to volunteer for this program and since it didn't cost anything he did... figuring what the heck it doesn't cost me anything. Well, a few years down the road that USDA volunteer thing became mandatory under the USDA/APHIS law and now costs a few hundred a year for the license.

Our animals here are also included in the APHIS law and if we want to continue raising and selling the animals we raise we have to be licensed, pay the fees, be inspected by the USDA, have a licensed vet that will work with us, and can only buy from other USDA licensed facilities. They do change the guidelines and regulations every so often and you have to keep up with the new guidelines if you want to stay licensed, the having to buy from another licensed facility was just in the last couple of years. So far we have been lucky here in that our inspector is a great person and easy to work with, but I have heard horror stories from those who's inspectors want to be God. And it's gotten to the point in some places where people would just as soon not get into this business due to all of the regulations, or go out business due to not being able to keep up to unrealistic demands from their inspector.

This is just an example of how something that doesn't seem all too bad to start out with grows to be something that is harder and harder to live with.

Good point, Pinky. It reminds me of cooking a frog. If Mr. Frog is gently immersed in a kettle of cool comfortable water, it is so enjoyable, and so pleasurable, that he doesn't even notice the very slow flame that is heating his water. He simply relaxes in the slowly heating water and sits there, even though he could jump out of the pot, until oblivion overtakes him and cooks him to death.

For many years I've watched the government employ the practice of the reduction of our freedoms by increments. For me, it's not a question of RFID chips in EZ passes that ease the congestion on toll roads because today those passes are used on a voluntary basis. But all too often these "voluntary" procedures are ultimately used to herald in technologies and regulations that inevitably become mandatory a few years down the road. And, all too often these changes in law go unnoticed by the population at large simply because they have been slowly "conditioned" to accept those changes without question because the steps that enforce those changes are established incrementally.

Have we become frogs in a pot? Is that the way our government looks at all of us today?