The Information and Privacy Commissioner of Ontario is speaking out about the proposed new ehanced drivers license, which is planning to use an RFID chip: New ID card threatens our privacy Canada News Toronto Sun.

Labels: privacy, rfid

I hope to have the time this weekend to make my way through the incredible variety of privacy-related articles in the most recent Scientific American. Thanks to Library Boy for pointing to this, which I surely would have missed had it not been for his link.

Check them all out:

• Industry Roundtable: Experts Discuss Improving Online Security
• Internet Eavesdropping: A Brave New World of Wiretapping
• How RFID Tags Could Be Used to Track Unsuspecting People
• Digital Surveillance: Tools of the Spy Trade
• Data Fusion: The Ups and Downs of All-Encompassing Digital Profiles
• Cryptography: How to Keep Your Secrets Safe
• Beyond Fingerprinting: Is Biometrics the Best Bet for Fighting Identity Theft?
• Tougher Laws Needed to Protect Your Genetic Privacy
• Do Social Networks Bring the End of Privacy?
• How Loss of Privacy May Mean Loss of Security
• Privacy in an Age of Terabytes and Terror

Labels: privacy, rfid

The Federal, Provincial and Territorial Privacy Commissioners came out yesterday against proposed RFID embedded super drivers licenses designed to facilitate border crossings:

Nova Scotia News - TheChronicleHerald.ca

Keep drivers' information in Canada — officials

Privacy commissioners slam plan to produce national identity cards

By DIRK MEISSNER

The Canadian Press

Wed. Feb 6 - 6:15 AM

VICTORIA — Personal information about Canadian drivers must stay in the country as plans are developed to introduce high-tech driver’s licences in Canada that will be accepted as identification at United States border crossings, Canada’s privacy commissioners said Tuesday.

The commissioners issued a joint statement that called on Ottawa and provincial and territorial governments participating in the so-called enhanced driver’s licence programs to ensure the personal information of participating drivers stays in Canada.

The commissioners also said they continue to voice their opposition to any plans to introduce national identity cards and systems.

British Columbia and the federal government reached an agreement last month to start issuing the enhanced driver’s licences on a trial basis. Ontario is examining a similar licensing program.

The enhanced licences, equipped with radio frequency chips, allow border officials to access personal identity information. They can be used as an alternative to a Canadian passport.

Jennifer Stoddart, Canada’s privacy commissioner, said her office is monitoring the progress of the enhanced driver’s licence program and recently received a government privacy-impact analysis. She said her office is not yet ready to give the green light to the licence program.

"Maybe our positions are more nuanced than that when we say with all these progressive and incremental steps towards measures that increasingly limit Canadians’ privacy, this is what you should be looking for," Stoddart said.

"These are the steps you need to follow," she said. "Have you chosen the least privacy-invasive route?"

David Loukidelis, B.C.’s privacy commissioner, said Canadians need to be reminded that a Canadian passport is a well-established, highly secure identification document.

"These enhanced driver’s licences or EDL programs do raise concerns about security and privacy of personal information on a number of fronts," Loukidelis said.

There are concerns that the radio frequency technology on the chips embedded into the licences could be skimmed by others or used to track individuals, he said.

The commissioners are concerned about the transfer across borders of databases containing personal information about Canadians, Loukidelis said.

"We don’t do that now with passport databases and we don’t see why we would need to do anything differently when it comes to enhanced driver’s licences."

The B.C. government has received 800 volunteers for the enhanced driver’s licence program within the first two days of the pilot project.

John van Dongen, Intergovernmental Affairs Minister, said 500 licences will be issued in British Columbia.

He said the information contained in the licences provides border officials with proof of citizenship, a photograph to confirm identity and status to legally cross the border.

"They do not access medical records," he said. "They do not access driver’s records. They do not access fines, tickets, penalties. They do not access accident history. None of that information is of any interest to the border agencies in either country."

Labels: bc, british columbia, privacy, rfid

The Privacy Commissioners of the provinces, territories and Canada are planning to speak out about RFID drivers licenses as part of their semi-annual get-together, being held in Victoria this week. This has been precipitated by BC's recent announcement to introduce a new RFID embedded license to facilitate border crossings. See: Code-broadcasting chips to be embedded in B.C. driver's licenses.

Labels: privacy, rfid

Over the holidays, the US government published information about a new passport card to facilitate travel by Americans in North America. One "feature" is causing a lot of concern: the technology (presumably RFID) built into the card means they can be read over a distance of up to eight metres. The cards will be issued with protective sleeves for those who want to use them, but this doesn't assuage privacy advocates who think the technology is inherently flawed. See: globeandmail.com: U.S. 'vicinity-read' cards assailed by privacy experts.

Labels: biometrics, passports, privacy, rfid

Hitachi has just unveiled a new generation of tiny RFID chips that are .15 mm X .15 mm. They're so small, they're nicknamed "dust".

See: Hitachi Develops World's Smallest RFID Chip - TFOT.

Labels: privacy, rfid

California has led the way in privacy legislation, much of which has largely been followed by other states. Will they follow with legislation similar to this to solve a problem that is more theoretical than real?

California outlaws the forced subdermal RFID tagging of humans:

"Worrying that your employer will force you to stick a small chip beneath your skin ranks low on the list of employee concerns in most parts of the country, but that didn't stop the state of California from passing a bill last week to ban such forced tagging of humans. The state senator who sponsored the bill called forced RFID tagging the 'the ultimate invasion of privacy,' and his bill is now on its way to the governor's desk for his signature. ..."

Labels: california, privacy, rfid

CAPAPA supports Canadian’s Right to Know
“Privacy IS Your Business”(Calgary, Alberta)

August 26, 2007 – CAPAPA (Canadian Association of Professional Access and Privacy Administrators) is pleased to support international Privacy Awareness Week, August 26th to September 1st, 2007. Privacy Awareness Week, a campaign first initiated by Privacy Victoria (Australia) in 2001, has for the first time gone international.

As Canada’s leading association serving privacy and access professionals, CAPAPA is spearheading the campaign to promote privacy awareness in Canada. “Identity theft and information security breaches are happening more often than ever,” says CAPAPA National Chair Sharon Polsky. “To reverse that trend, Canadians must recognize the importance of protecting their personal information — at home, in the workplace, and in the consumer marketplace.”

Privacy Awareness Week provides an opportunity for individuals to raise questions about privacy legislation and its impact on how individuals conduct their business and personal lives. Privacy Awareness Week spotlights the need for Canadians to recognize their rights and obligations to maintain the privacy of their personal information. The theme for Privacy Awareness Week 2007 is ‘Privacy is your business'.

Know your Rights and Obligations


Canadian organizations, governments, and government agencies are bound by a variety of wide-reaching privacy laws. Ms. Polsky notes that, “As consumers, each of us is responsible to understand what our rights and responsibilities are under those laws.”

CAPAPA is a key source for helping Canadians recognize their privacy rights and responsibilities, and is the privacy advocate’s source for issues such as the passenger name record exchange, emerging RFID CHIP technology, and CAPAPA's Submission to the Senate on proposed changes to Canada’s Election Act.

More information on these and other Canadian privacy issues is at http://www.capapa.org./ For more information on how you can promote Privacy Awareness Week 2007, visit http://www.capapa.org/ or contact CAPAPA at: info@capapa.org.

Labels: alberta, identity theft, privacy, rfid

One of two initiatives in Congress, which may never see the light of day, would replace the flimsy social security card with a biometric ID that employers would be required to verify before employing anybody.

National ID: Biometrics Pinned to Social Security Cards

The Social Security card faces its first major upgrade in 70 years under two immigration-reform proposals slated for debate this week that would add biometric information to the card and finally complete its slow metamorphosis into a national ID.

The leading immigration proposal with traction in Congress would force employers to accept only a very limited range of approved documents as proof of work eligibility, including a driver's license that meets new federal Real ID standards, a high-tech temporary work visa or a U.S. passport with an RFID chip. A fourth option is the notional tamper-proof biometric Social Security card, which would replace the text-only design that's been issued to Americans almost without change for more than 70 years.

A second proposal under consideration would add high-tech features to the Social Security card allowing employers to scan it with specially equipped laptop computers. Under that proposal, called the "Bonner Plan," the revamped Social Security card would be the only legal form of identification for employment purposes.

Neither bill specifies what the biometric would be, but it could range from a simple digital photo to a fingerprint or even an iris scan. The proposals would seem to require major changes to how Social Security cards are issued: Currently, new and replacement cards are sent in the mail. And parents typically apply for their children before they're old enough to give a decent fingerprint.

There are also logistical problems to overcome before forcing all of the nation's employers to verify a biometric card -- given the nation has millions of employers, many of whom may not have computer equipment at all....

Labels: laptop, privacy, rfid

The United States Department of Defence is requiring suppliers of some commodities to use passive RFID chips to identify and inventory supplies. From Cryptome: DoD Final Rule on RFID Spy Chips.

Labels: privacy, rfid

Labels: biometrics, privacy, rfid

A company has developed an RFID tattoo, that has all the benefits of RFID implantation, but without the messy chip. The chip is replaced by a tattoo. The company is touting its benefits in traceability of the meat supply, but is also suggesting that it may be useful in soldiers:

Industrial Control Designline RFID Ink

... The ink also could be used to track and rescue soldiers, Pydynowski said.

"It could help identify friends or foes, prevent friendly fire, and help save soldiers' lives," he said. "It's a very scary proposition when you're dealing with humans, but with military personnel, we're talking about saving soldiers' lives and it may be something worthwhile."

I can't imagine anything more dangerous than tagging all soliders with a tracking device that may be hacked by the other side. Instead of saving lives, it may result in wholesale destruction. I wonder how long it would be before we saw RFID activated IEDs? Not long, I expect.

Thanks to Schneier for the link.

Labels: privacy, rfid, schneier

If you have been run out of Wisconsin and were thinking you'd while away the day wandering through Colorado, implanting RFID chips in unsuspecting citizens, think again. Colorado has joined the aforementioned cheesy state to make it a misdemeanor to require chipping of individuals. See: Rocky Mountain News - Bill would nip chips in humans.

There are still a few states left that haven't abridged the right to chip.

Thanks to Objective Justice for the link.

Labels: privacy, rfid, surveillance

Engadget featured an interesting product this week that you can put in your wallet or attach to your cell phone to supposedly thwart would-be skimmers from gaining access to the data on contactless (read: RFID) cards. See: Elecom intros skim prevention kit for wallet, cellphone - Engadget.

Labels: privacy, rfid

Want to disable the always-on, non-secure RFID in a passport issued after January 1, 2007? The old fashioned way is the most effective, according to Wired.

Labels: privacy, rfid

Move along, move along. Nothing to see here.

According to Bloomberg, the country that brought you the Magna Carta, pervasive surveillance, RFID passports and national ID cards is testing a new upgrade of CCTV surveillance technology. Instead of just standing idly by as passive sentries, cameras in Middlesbrough will be able to yell at ne'er do wells and miscreants.

George Orwell Was Right: Spy Cameras See Britons' Every Move

By Nick Allen

Dec. 22 (Bloomberg) -- It's Saturday night in Middlesbrough, England, and drunken university students are celebrating the start of the school year, known as Freshers' Week.

One picks up a traffic cone and runs down the street. Suddenly, a disembodied voice booms out from above:

``You in the black jacket! Yes, you! Put it back!'' The confused student obeys as his friends look bewildered.

``People are shocked when they hear the cameras talk, but when they see everyone else looking at them, they feel a twinge of conscience and comply,'' said Mike Clark, a spokesman for Middlesbrough Council who recounted the incident. The city has placed speakers in its cameras, allowing operators to chastise miscreants who drop coffee cups, ride bicycles too fast or fight outside bars.

Almost 70 years after George Orwell created the all-seeing dictator Big Brother in the novel ``1984,'' Britons are being watched as never before. About 4.2 million spy cameras film each citizen 300 times a day, and police have built the world's largest DNA database. Prime Minister Tony Blair said all Britons should carry biometric identification cards to help fight the war on terror.

``Nowhere else in the free world is this happening,'' said Helena Kennedy, a human rights lawyer who also is a member of the House of Lords, the upper house of Parliament. ``The American public would find such inroads into civil liberties wholly unacceptable.''

During the past decade, the government has spent 500 million pounds ($1 billion) on spy cameras and now has one for every 14 citizens, according to a September report prepared for Information Commissioner Richard Thomas by the Surveillance Studies Network, a panel of U.K. academics.

...

Thanks to Rob Hyndman for passing along the link.

Labels: privacy, rfid, surveillance, video surveillance

CNet 2006: A privacy and surveillance year in review. Some highlights:

2006 Highlights

Gonzales: NSA may tap 'ordinary' Americans' e-mail

During Senate hearing, attorney general declines to offer reassurances about a secret surveillance program.

February 6, 2006

Judge: Google must give feds limited access to records

Privacy-aware ruling says search giant must turn over a swath of indexed URLs--but not users' queries.

March 17, 2006

Special report: Silicon Money

CNET News.com chronicles the dramatic increase in tech industry lobbying while highlighting big spenders.

March 27, 2006

Appeals court upholds Net-wiretapping rules

Bush administration's Net surveillance plans receive boost from appeals court, which refused to overturn rules.

June 9, 2006

Feds appeal loss in NSA wiretap case

Bush administration asks the 9th Circuit to halt a lawsuit that accuses AT&T of illegally opening its network to the NSA.

July 31, 2006

AOL's disturbing glimpse into users' lives

Release of three-month search histories of about 650,000 users provides rare glimpse into their private lives.

August 7, 2006

RFID passports arrive for Americans

State Department to begin handing out RFID-equipped passports despite lingering security, privacy concerns.

August 14, 2006

Post-9/11 antiterror technology: A report card

As September 11 nears, News.com examines five useful ways of improving security--and five that should raise eyebrows.

September 7, 2006

Post-9/11 privacy and secrecy: A report card

Since September 11, the federal government has been trying to learn more about us, while keeping us from knowing what it's doing. Is this wise?

September 8, 2006

FBI director wants ISPs to track users

Robert Mueller becomes latest Bush administration official to call for ISPs to store customers' data.

October 17, 2006

Technology voter guide 2006: Rating politicians

How did U.S. politicians vote on tech-related proposals? Find out by clicking on a state, then on a name.

November 2, 2006

FBI taps cell phone mic as eavesdropping tool

Agency used novel surveillance technique on alleged Mafioso: activating his cell phone's microphone and then just listening.

December 1, 2006

Bush's privacy watchdogs make public debut

At first public meeting, White House panel hears from civil-liberties advocates but sheds little light on supposed watchdog role.

December 5, 2006

Congress and tech: Little to show

Lawmakers made a lot of noise over MySpace, China and Net neutrality, but tech-related laws were hard to come by.

December 11, 2006

Labels: google, law enforcement, privacy, rfid, surveillance

Bruce Schneier recently linked to an interesting project that set up a surveillance system to track people using the Nike/iPod Sport Kit. The kit's intended use is to have your shoes talk to your iPod Nano to track your run. However, the shoes transmit a unique ID more than sixty feet to whoever may be listening in. With less than $250 in equipment, the researchers were able to track unwitting joggers.

As one commenter noted at Bruce's blog, perhaps we can't call them sneakers any more...

Labels: privacy, rfid, schneier, surveillance

Cracked it! Special reports Guardian Unlimited:

...By last month, Booth, Laurie and I each had access to a new biometric chipped passport and were ready to begin testing them. Laurie's first port of call was the ICAO's website, where the organisation had published specifications for the new travel documents. This is where he learned that the key to opening up the secure chip was contained in the passports themselves - passport number, date of birth and expiry date.

"I was amazed that they made it so easy," Laurie says. "The information contained in the chip is not encrypted, but to access it you have to start up an encrypted conversation between the reader and the RFID chip in the passport.

"The reader - I bought one for £250 - has to say hello to the chip and tell it that it is authorised to make contact. The key to that is in the date of birth, etc. Once they communicate, the conversation is encrypted, but I wrote some software in about 48 hours that made sense of it.

"The Home Office has adopted a very high encryption technology called 3DES - that is, to a military-level data-encryption standard times three. So they are using strong cryptography to prevent conversations between the passport and the reader being eavesdropped, but they are then breaking one of the fundamental principles of encryption by using non-secret information actually published in the passport to create a 'secret key'. That is the equivalent of installing a solid steel front door to your house and then putting the key under the mat."

Within minutes of applying the three passports to the reader, the information from all of them has been copied and the holders' images appear on the screen of Laurie's laptop. The passports belong to Booth, and to Laurie's son, Max, and my partner, who have all given their permission....

Labels: laptop, privacy, rfid

I am sometimes left scratching my head wondering why the medical (and dental) field are among the first to adopt intrusive technologies. For example, a Winnipeg dentist has started fingerprinting his patients so that they can sign in by just touching a screen. (CBC: Fingerprinting dental patients raises privacy concerns.) Apparently, it improves privacy:

Michael Lasko, registrar of the Manitoba Dental Association, thinks it could be the way of the future for identifying patients in dentistry and medicine.

"It's probably the easiest and most secure method of maintaining patient privacy," said Lasko.

He said fingerprints help patients maintain their anonymity by eliminating the need for conversations about personal health information at the reception desk.

What's next? Implanting RFID chips in patients? Oh, too late.

Labels: health information, privacy, rfid

The Associated Press is reporting that Marnlen Management Ltd. is the first company to adopt IBM's "clipped tag" concept that allows these special RFID tags to be disabled by clipping off the antenna: Company adopts 'clipped tag' technology - Yahoo! News

Labels: privacy, rfid

Today's New York Times is running a very interesting article on the next battle over RFID: the mass rollout out proximity-based consumer credit cards. The latest fuss particularly relates to alleged defects in the implementation of RFID that allow researchers (and perhaps malevolent folks) to read cards en clair from a distance. See: Researchers See Privacy Pitfalls in No-Swipe Credit Cards - New York Times.

Labels: id swiping, privacy, rfid

Labels: privacy, rfid

BBC News, via Boing Boing! is reporting that a British research instutite is field testing a new surveillance system at an airport in Hungary. The system combines RFID and video surveillance to track people throughout the airport. There are two wrinkles to be worked out: (i) making sure that passengers can't remove or swap their tags and (ii) those pesky things called "civil liberties". Hmm. Might I be so bold as to suggest (i) tracking collars and (ii) saying that only evildoers need worry about civil liberties?

BBC NEWS Technology Air passengers 'could be tagged':

Electronically tagging passengers at airports could help the fight against terrorism, scientists have said.

The prototype technology is to be tested at an airport in Hungary, and could, if successful, become a reality "in two years".

The work is being carried out at a new research centre, based at University College London, set up to find technological solutions to crime.

Other projects include scanners for explosives and dirty bomb radiation.

Dr Paul Brennan, an electrical engineer, is leading the tagging project, known as Optag.

He said: "The basic idea is that airports could be fitted with a network of combined panoramic cameras and RFID (radio frequency ID) tag readers, which would monitor the movements of people around the various terminal buildings."

The plan, he said, would be for each passenger to be issued with a tag at check-in.

He said: "In our system, the location can be detected to an accuracy of 1m, and video and tag data could be merged to give a powerful surveillance capability."

Civil liberties

The tags do not store any data, but emit a signal containing a unique ID which could be cross-referenced with passenger identification information. In the future, added Dr Brennan, this could incorporate biometric data.

The project still needs to overcome some hurdles, such as finding a way of ensuring the tags cannot be switched between passengers or removed without notification.

The issue of infringement of civil liberties will also be key.

But potentially, said Dr Brennan, the tags could aid security by allowing airports to track the movement patterns of passengers deemed to be suspicious and prevent them from entering restricted areas.

It could also aid airports by helping evacuation in case of a fire, rapidly locating children, and finding passengers who are late to arrive at the gate.

The "proof of concept" of the system is about to be tested at Debrecen airport in Hungary. If successful, claimed Dr Brennan, it could be available elsewhere within two years.

The new centre will also be investigating a range of other airport security tools.

Labels: air travel, airlines, breach notification, privacy, rfid, surveillance, video surveillance

Last week, Business Week ran a very interesting article on new technologies being implemented by retailers to curtail shoplifting and other species of fraud. From smart video systems that can detect unusual patterns supposedly indicative of shoplifting to RFID-enabled shopping carts that lock down the wheels in a "push out" scam, the technology is rather impressive and potentially intrusive. Much of it is being implemented covertly, so they don't tip off the miscreants and out of fear of a privacy backlash. See: Attention, Shoplifters. Via Privacy Digest.

Labels: privacy, rfid

Ritek Corporation, one of the leading manufacturers of DVDs, is moving to embed RFID chips in DVDs to prevent counterfeiting, allow inventory tracking, regional lock-downs and perhaps invasions of privacy. The chips will be read by point of sale systems and individual DVD players.

DVD chips 'to kill illegal copying' - vnunet.com

U-Tech described this as the "real end game" for the chip-on-disc technology, which would "eliminate optical disc piracy in the entertainment and IT sectors" .

IPICO claims that its RFID tags can be read from at least six metres away, and at a rate of thousands of tags per minute. The passive chips require no battery, as they are powered by the energy in radio waves from the RFID reader.

"I have envisioned using RFID to improve product visibility and enhance security in the optical disc industry for some time," said Yeh.

"Launching the chip-on-disc system has made this dream a reality and holds the potential to protect the intellectual property of music companies, film studios, gaming and software developers worldwide."

Gordon Westwater, president of IPICO, added: "[This is the] first step towards new international standards to safeguard optical media, and the subsequent adoption of the chip-on-disc concept as a global standard."

Via: Embedded RFID to smack-down DVD piracy - Engadget.

Labels: privacy, rfid

Cryptome is hosting a flash animation that illustrates the possible use of RFID for people and baggage tracking, and data matching at airports. Check it out here.

Labels: air travel, airlines, privacy, rfid

The only surprise is that it happened so quickly....

According to recent reports, supposedly secure VeriChips (an implantable RFID chip) can be cloned, defeating their utility as a means of authentication. See: Techdirt: VeriChip VeriEasy To Clone, Researchers Say.

Labels: privacy, rfid

Saturday's Globe & Mail had an interesting article on RFID, which is now online in the Globe's technology section: globeandmail.com : Who's watching the watchers? I find these articles to be interesting, but often overstate the threat that RFID poses in Canada. Most of the concern is that item-level tagging of purchased items will lead to the ability to track individuals once they have left the store. While this might theoretically be possible, the advent of a new technology does not mean that Canadian laws go out the window.

Every retail operation in Canada is governed by privacy laws, either PIPEDA or a substantially similar equivalent. Among other things, these laws require that the collection of personal information be reasonable and that personal information only be collected with the knowledge and the consent of the individual. I have no doubt that the unique identifier in a purchased item's RFID tag, when attached to any other information about an individual, is personal information for the purposes of these statutes. Therefore, in Canada:

1. Any retail operation using RFID in Canada has to inform customers;
2. Any retail operation that matches an RFID serial number to any personal information has to get the consent of the consumer; and
3. You cannot require a consumer to consent to a collection, use or disclosure of personal information that is unreasonable or is for a purpose not identified to the individual.

Essentially, this means that retailers cannot covertly use RFID to track consumers in this country. The situation is entirely different in the US where no general privacy law covers the retail sector.

If you want any more information on RFID and Canadian privacy law, check out this great report by Teresa Scassa, Michael Deturbide, Theodore Chiasson and Anne Uteck of Dahousie's Law and Technology Institute: An Analysis of Legal and Technological Privacy Implications of Radio Frequency Identification Technologies. This report was funded by the Privacy Commissioner's contributions programme.

Update:

In a letter to the editor in today's Globe & Mail (July 25, 2006), Anne Cavoukian responds to the article from Saturday's paper:

globeandmail.com : RFIDs track products:

"RFIDs track products

ANN CAVOUKIAN Information and Privacy Commissioner of Ontario

Toronto -- The article Who's Watching The Watchers? (July 22) suggests that Katherine Albrecht was invited 'back' to brief my office on Radio Frequency Identifiers (RFIDs). I would like to make this perfectly clear -- she was never there, nor was she ever invited. Meanwhile, the article's characterization of RFIDs as spy chips is misleading.

Let's have a reality check. Currently in Canada, RFID tags are used in the supply-chain process for inventory control (tracking products, not people), which involves no privacy issues. But in future, if and when RFIDs are embedded into consumer products and linked to personal identifiers, we must remain vigilant to ensure that they are deployed in a manner that does not threaten privacy.

I have been studying RFIDs since 2003 and recently issued RFID privacy guidelines to address the future prospect of item-level, potentially privacy-invasive, RFIDs. I am a fierce protector of privacy but also believe in describing issues fairly and evenly. What we need is public education about this technology rather than fear mongering.

Misrepresenting RFIDs only serves to keep the public in the dark."

Labels: privacy, rfid

Most of what you hear about RFID these days has people donning tinfoil hats. Many feel that privacy should not be the price to pay for personalization or supply chain management. But how about saving your life? Researchers at Stanford University have finished a pilot project in which surgical sponges were tagged using RFID to prevent the unfortunate "sewed up with a sponge inside" syndrome. If I've learned anything from Gray's Anatomy, it's that this can have nasty side effects. With tagged sponges, a quick scan with a reader will let surgeons know whether a sponge is somewhere it shouldn't be before suturing. Naturally, they're looking at tagging all sorts of surgical implements in addition to sponges. See: RFID to prevent loss of surgical sponges inside patients - Engadget.

Labels: privacy, rfid

The Privacy Commissioner of Canada has commissioned a poll on Canadians' attitudes on privacy issues. It just came out, so I haven't reviewed it yet but the Commissioner's release is below:

CNW Group: "Poll says Canadians want personal information treated more responsibly

OTTAWA, June 30 /CNW Telbec/ - Canadians want the government and businesses to take their responsibility for safeguarding personal information more seriously, according to the Privacy Commissioner of Canada, Jennifer Stoddart, who released today the findings from a poll commissioned by her Office. The study reveals that most Canadians believe that neither the government nor businesses take their responsibility to protect their personal information very seriously. Only 14 per cent of Canadians believe that the federal government takes its responsibility to protect personal information very seriously and only 11 per cent are confident that businesses take this responsibility very seriously.

"The current government has pledged to make accountability a trademark of government operations, and I can't think of a better way to demonstrate this principle, than by holding it to account for the way in which it treats the personal information," says Privacy Commissioner Jennifer Stoddart. "Establishing sound privacy management frameworks would help organizations protect individuals' personal information by identifying the inherent privacy risks, and how best to mitigate those risks."

In March 2006, The Office commissioned a public opinion study by EKOS Research Associates to revisit benchmarks from the previous year and to better meet Canadians educational needs about privacy.

While Canadians do not consider privacy on par with priorities such as healthcare and education, they place updating privacy laws on similar footing to issues such as ethics and accountability, public security and taxation. In fact, according to the study, close to 90 per cent take it as a given that the rapid pace of technological innovation means that existing privacy legislation needs to be updated regularly and virtually no one believes there is little need to modernize the law. These findings support the Commissioner's calls for reform of the Privacy Act, which covers the personal information handling practices of federal departments and agencies. The Privacy Act is a first generation privacy law that has not been substantially amended since its inception in 1983. On June 5, 2006 the Commissioner tabled her proposals for reform of the Act with the House of Commons Standing Committee on Access to Information, Privacy and Ethics.

"The Privacy Act is an often inadequate public sector data protection law that is woefully out of date," says Ms. Stoddart. "Since my appointment, I have been urging the Government of Canada to reform the Privacy Act. My recommendations to Parliament call for strengthening the Act to address critical issues such as the transborder data flow of personal information."

According to the study, approximately two-thirds of Canadians surveyed are highly concerned about their government's transfer of individual personal information across borders, by outsourcing works to companies in the U.S. The privacy implications related to the USA PATRIOT Act has become the symbol of the increasing concern of Canadians about the security of their personal information when it leaves Canada. In fact, almost 90 per cent of those who are aware of the USA PATRIOT Act express some concerns about the law.

In late March 2006, the Treasury Board released a national strategy and guidelines to address the public's heightened concerns over the transborder flow and the possible privacy risks posed by foreign legislation such as the USA PATRIOT Act. Although the initiative was commended by the Privacy Commissioner as a welcome step toward addressing the concerns, a modernized Privacy Act would further strengthen the federal privacy regime.

Other key highlights of the 2006 EKOS survey:

• The proportion of Canadians reporting that they have a good or very good understanding of their privacy rights has doubled since 2001, rising from 13 to 26 per cent, which suggests that Canadians may be taking more control over of their personal information. Perhaps this explains why more than 85 per cent of them want to be informed by companies about the privacy implications of products or services they buy.
• Approximately 8 in 10 Canadians believe their country should be equipped with strong laws to protect their personal information. The inability to have strong privacy legislation will continue to undermine trust in their government to protect their personal information seriously.
• Although Canadians are among the most technology savvy in the world and they understand that processing personal information is core to a modern and competitive economy, only 50 per cent of those polled say they have enough information to know the privacy implications of new technologies. In response to this need and to better serve Canadians, the Office is developing information and guidance to help individuals better understand the privacy risks and implications of new technologies such as radio frequency identification devices (RFID).

The Office of the Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman, advocate and guardian of privacy rights in Canada.

For a copy of the 2006 EKOS Research Associates survey, please visit: Revisiting the Privacy Landscape a Year Later (www.privcom.gc.ca)

Labels: health information, patriot act, privacy, rfid

Anne Cavoukian has tabled her annual report for 2005 in the Ontario Provincial Parliament. I haven't had a chance to review it in detail, but it appears to be full of interesting information.

Here is the media release:

IPC - Government spending must be open to the public: Commissioner Cavoukian says greater transparency needed:

NEWS RELEASE : June 27, 2006

Government spending must be open to the public: Commissioner Cavoukian says greater transparency needed

While considerable gains have been made, government organizations nonetheless continue to use the Freedom of Information and Protection of Privacy Act as a shield to block the release of consultants’ contracts and the financial arrangements made with suppliers of goods and services, said Information and Privacy Commissioner Ann Cavoukian.

Since early 2005, the IPC has overturned 11 decisions made by provincial or municipal organizations that refused to disclose this type of information. The requesters seeking the information had to appeal those decisions to my office to obtain the desired records, said Commissioner Cavoukian. Other requesters may have just given up, not bothering to file an appeal. “This is a complete waste of the time and resources of all parties involved,” said the Commissioner, who is urging municipal and provincial government organizations in Ontario to make a concerted effort towards ensuring that the public has full access to government spending records.

In her 2005 annual report, which she released today, Commissioner Cavoukian is asking every government office planning to hire a consultant, contractor, or service provider to immediately make it clear to them that the information they submit will most likely be made available to the public. “The default position should be that financial and all other pertinent information related to a contract will be made publicly available,” said Commissioner Cavoukian. Only in exceptional circumstances will withholding the financial terms of government contracts be justified on the basis of prejudice to one’s competitive position or privacy.

“The right of citizens to access government-held information is essential in order to hold elected and appointed officials accountable to the people they serve,” said the Commissioner. “This is particularly true for details of government expenditures and the public’s right to scrutinize how tax dollars are being spent. When government organizations use the services of individuals or companies in the private sector, the public should not lose its right to access this information.”

The need for transparency and accountability for government spending goes beyond contractual arrangements. In Order MO-1947, the Commissioner ordered the disclosure of information relating to lawsuits settled by the City of Toronto with third parties, including the number of lawsuits, dates settled and dollar amounts. The Commissioner again emphasized the importance of the disclosure of this type of information based on the taxpayers’ right to know and the need to hold both politicians and bureaucrats accountable for their actions.

In her wide-ranging 84-page annual report, Commissioner Cavoukian identifies and addresses seven other key issues. Among these, the Commissioner:

• dispells some of the common misconceptions about radio frequency identification (RFID) and addresses when privacy issues need to be considered. “ Users of RFID technologies and information systems should address the privacy and security issues early in the design stage, with a particular emphasis on data minimization,” said the Commissioner. “This means that wherever possible, efforts should be made to minimize the identifiability, observability and linkability of RFID data.” (Further to this issue, the Commissioner released new RFID Privacy Guidelines just last week. Here is a direct link to the Guidelines on the IPC’s website: www.ipc.on.ca/docs/rfidgdlines.pdf.);
• outlines a highly successful collaboration between the Ontario College of Pharmacists, the Ontario Pharmacists’ Association and the IPC. Within days of a controversy erupting in the media over the screening of womenattempting to access the emergency contraceptive pill, commonly known as Plan B, the Ontario College of Pharmacists, after working with the Commissioner and the Association, issued new guidelines for pharmacists operating in Ontario;
• examines the issue of the secure destructionof personal information, emphasizing that such information “must be permanently destroyed or erased in an irreversible manner that ensures the record cannot be reconstructed in any way, as reflected in the IPC Fact Sheet issued on secure destruction;”
• advises that the IPC is closely watching the steps being taken towards the development of an interoperable electronic health record (EHR) system in Ontario. “Governance is a key issue in the implementation of an interoperable E HR,” said Commissioner Cavoukian. “One of the questions that needs to be addressed is how will accountability for patient privacy and information security be established in the context of a record that may eventually be shared throughout the entire health care system;”
• stresses that privacy should not be used as a shield to minimize disclosure of essential information in emergency situations. “While access and privacy laws underline the importance of protecting the privacy of individuals, they also recognize that, in certain circumstances, privacy should not be an impediment to the sharing of vital – and, in some cases, life-saving – information, even in the absence of consent,” says the Commissioner;
• addresses the issue of fingerprints, photos and other personal information of people who were charged with a crime, but never convicted, being kept by police. “Many people assume that when charges are dropped, stayed, withdrawn, or a finding of ‘not guilty’ is made, the name of the accused person is automatically cleared,” said the Commissioner. “However, while these and other non-conviction dispositions may leave a person without a criminal record, police services in Ontario retain most police records in perpetuity, even where a person is found not guilty by the courts. A fair expungement process must take into account both the legitimate interest of law enforcement and the fundamental rights of innocent citizens;” and
• emphasizes the importance of building a culture of openness and transparency in all provincial and municipal government organizations. “Leadership on openness and transparency must come from the top,” said the Commissioner. “Public servants are more apt to disclose information without claiming inapplicable exemptions if they feel that their decisions will be supported by both the politicians and senior executives who lead their ministry, agency, board, commission or local government.”

The annual report also includes a detailed review of the impact of the Personal Health Information Protection Act (PHIPA) – Ontario’s first new privacy law in nearly 14 years – during its first full year.

Provincial ministries were praised by the Commissioner for a dramatic improvement in their 30-day-response compliance rate. Overall, ministries achieved an 80.1 per cent compliance rate – a significant increase from 68.7 per cent in 2004 and the highest provincial compliance rate in 17 years.

Elsewhere, the annual report includes statistical analysis of requests for information filed across Ontario in 2005 under FOI and PHIPA (34,957, the highest number ever), appeals to the IPC regarding some of the decisions government organizations made in response to FOI requests, and privacy complaints filed to the IPC under the provincial and municipal Freedom of Information and Protection of Privacy Acts, or under PHIPA.

Key IPC orders and privacy investigations are profiled, decisions rendered by the courts regarding Ontario access cases are cited, IPC educational efforts outlined, and information about the 25 publications the IPC issued in 2005 provided.

The Information and Privacy Commissioner is appointed by and reports to the Ontario Legislative Assembly, and is independent of the government of the day. The Commissioner's mandate includes overseeing the access and privacy provisions of the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act, as well as the Personal Health Information Protection Act, and helping to educate the public about access and privacy issues.

Labels: health information, ontario, phipa, privacy, rfid

My kids just taught me that Darth Vader can read my mind. (It apppears to work even if you're wearing your tifoil hat.) I thought that was bad. Now Schneier and Boing Boing are telling me that any nerd with a soldering iron and directions to Radio Shack (or the Force, I guess) can read the RFIDs in my pocket. What is the world coming to? Check this out: How to Build a Low-Cost, Extended-Range RFID Skimmer.

Labels: privacy, rfid, schneier

Ontario's Information and Privacy Commissioner has just produced a set of guidelines for implementing RFID technology to better protect privacy in its implementation. The guidelines are here and are being released along with a companion Practical Tips for Implementing RFID Privacy Guidelines. Earlier this month, the Commissioner released Worried about RFIDs? in video and paper form.

The Commissioner's press release is here:

Commissioner Cavoukian issues RFID Guidelines aimed at protecting privacy

TORONTO, June 19 /CNW/ - Ontario's Information and Privacy Commissioner, Dr. Ann Cavoukian, today released privacy Guidelines for the growing field of radio frequency identification (RFID).

These Guidelines flow from her earlier work in 2003 when the Commissioner first identified the potential privacy concerns raised by RFID technology. Following a history of ground-breaking work on building privacy into the design of emerging technologies, these Guidelines are a natural progression of this pragmatic approach.

"I have always found it beneficial to assist those working on emerging technologies, and to be proactive whenever possible - to develop effective guidelines and codes before any problems arise," said Commissioner Cavoukian. "These made-in-Canada Guidelines provide guidance and solutions regarding item-level consumer RFID applications and uses."

EPCglobal Canada, an industry association that sets standards for electronic product codes, has been collaborating with the IPC in the development of these Guidelines, and will be seeking Board approval by its member companies to signify the association's endorsement of the Guidelines.

"This technology offers exciting benefits to consumers and businesses alike. As the trusted source for driving adoption of EPC/RFID technology for increased visibility within the supply chain, privacy is as important as anything else we are doing," said Art Smith, President and CEO, EPCglobal Canada. "We promote an environment that encourages ongoing innovation while respecting privacy issues."

RFID tags contain microchips and tiny radio antennas that can be attached to products. They transmit a unique identifying number to an electronic reader, which in turn links to a computer database where information about the item is stored. RFID tags may be read from a distance quickly and easily, making them valuable for managing inventory but pose potential risks to privacy if linked to personal identifiers. RFID tags are the next generation technology from barcodes.

Although RFID technology deployed in the supply chain management process poses little threat to privacy, item-level use of RFID tags in the retail sector, when linked to personally identifiable information, can facilitate the tracking and surveillance of individuals. The goal of these Guidelines is to alleviate concerns about the potential threat to privacy posed by this technology and to enhance openness and transparency about item-level use of RFID systems by retailers.

The Guidelines address key privacy issues regarding the use of RFID technology at an item-level in the retail sector, said Commissioner Cavoukian.

The Guidelines are based on three overarching principles, including:

• Focus on RFID information systems, not technologies: The problem does not lie with RFID technologies themselves, but rather, the way in which they are deployed that can have privacy implications. The Guidelines should be applied to RFID information systems as a whole, rather than to any single technology component or function;
• Build in privacy and security from the outset - at the design stage: Just as privacy concerns must be identified in a broad and systemic manner, so, too, must the technological solutions be addressed systemically. A thorough privacy impact assessment is critical. Users of RFID technologies and information systems should address the privacy and security issues early in the design stages, with a particular emphasis on data minimization. This means that wherever possible, efforts should be made to minimize the identifiability, observability and linkability of RFID data; and
• Maximize individual participation and consent: Use of RFID information systems should be as open and transparent as possible, and afford individuals with as much opportunity as possible to participate and make informed decisions.

A companion piece to the Guidelines - Practical Tips for Implementing RFID Privacy Guidelines, is also being released by the Commissioner to help organizations put the Guidelines into practice.

The Guidelines and Practical Tips for Implementing RFID Privacy Guidelines are available on the IPC's website (www.ipc.on.ca).

Labels: information breaches, ontario, privacy, rfid, surveillance

David Canton's latest column is all about RFID and privacy. Check it out on his great glog: Privacy protection paramount with RFID.

Labels: information breaches, rfid

This is interesting (and unexpected):

DHS Privacy Office Bashes RFID Technology To Track People - Yahoo! News:

The Department of Homeland Security's Privacy Office has issued a draft report that strongly criticizes privacy and security risks of using radio frequency identification devices for human identification. Public comment on the paper is being taken until May 22.

The privacy office says the technology offers little performance benefit for identification purposes compared with other methods and could turn the government's identification system into a surveillance system.

Labels: homeland security, information breaches, rfid, surveillance

Wired is running an article on RFID hackers, highlighting that it is rather easy for RFID chips to be hacked/cloned/altered/abused using a little knowledge and some off the shelf equipment: Wired 14.05: The RFID Hacking Underground.

Labels: information breaches, rfid

Network World is running two interesting articles on RFIDs and privacy, both of which include reference to IBM's growing role in this field:

IBM demos RFID tag with privacy-protecting features - Network World:

"The latest to tackle the issue is IBM, which this week is expected to demonstrate its design for an RFID tag with a disabling feature that limits - but doesn't kill - a wireless chip's ability to broadcast item information.

The Clipped Tag gives consumers the option to disable RFID tags on items they purchase without eliminating the possibility that the tags could be used later to expedite product returns or recalls, says Paul Moskowitz, a research staff member at IBM's Watson Research Center in Hawthorne, N.Y. The design calls for a product label with perforations 'like a sheet of postage stamps,' he says.

After purchasing a tagged item, a consumer can tear the Clipped Tag label along the perforations to remove a portion of the tag's antenna, reducing its transmission capability. 'When you do that, you do not kill the tag completely. The chip is still there, and it has some of the antenna left. But you've just taken a tag that may have had a 30-foot range and reduced the range to just a few inches.' "

IT vendors, privacy groups release RFID standards - Network World:

"Companies using RFID tags on products should notify customers in all cases, should tell customers whether they can deactivate the tags and should build security into the technology as a primary design requirement, the group said. "

Privacy RFID Surveillance Retail

Labels: information breaches, rfid, surveillance

Levi's is apparently rolling out a test of using radio frequency ID tags (RIFDs) to track inventory in a select number of retail outlets. The RFIDs, which contain an individual serial number are on a dangling tag marked "Please discard this tag if it is not removed at the point of purchase." Not surprisingly, some see conspiracy afoot and are concerned about the privacy aspects of wider adoption of RFIDs on consumer goods. See: Advertising Age - Privacy Group Slams Levi's for Radio ID Tags.

Privacy Personal+Information RFID Surveillance Retail Jeans Apparel

Labels: information breaches, retail, rfid, surveillance

A good part of today's Sunday Edition on CBC Radio One is all about privacy. Here's a snapshot of the show:

CBC SCHEDULE:

"This morning, we broadcast a public forum, recorded on Monday at the Library and Archives Canada in Ottawa, titled Just Watch Us - The End of Privacy. We look at the increasing use of information in our daily life by the government and businesses and whether we're willing to give up our privacy for security in this post 9/11 world.

Joining Michael were:

Senator Raynell Andreychuk, former deputy chair of the Senate's special committe on the Anti-Terrorism Act, a Progressive-Conservative from Saskatchewan, a former lawyer and judge.

Michael Geist, Canada Research Chair of Internet and E-Commerce Law, Faculty of Law, University of Ottawa

Janice L. Kephart, counsel to the 9/11 Commission and expert on the Western Hemisphere Travel Initiative, based in Washington, D.C.

Liz McIntyre, co-author Spychips: How Major Corporations and Government Plan to Track Your Every Move with RFID (Nelson Current, 2005), based in Austin, Texas

Reid Morden, former director, CSIS, President of Reid Morden & Associates, a security consultancy group in Toronto

Jennifer Stoddart, Privacy Commissioner of Canada"

You can listen online at from the links here: http://www.cbc.ca/listen/index.html. The show starts at 9:11am in each Canadian time zone. It doesn't look like it will be available unless after the fact.

Labels: information breaches, rfid

According to Engadget (which got the story via The Register and Vara (Dutch)), the new (prototype) RFID technology being implemented in Dutch passports has been cracked:

Dutch RFID e-passport cracked -- US next? - Engadget:

"A Dutch television program 'Nieuwslicht' recently worked with local security firm Riscure to successfully crack and decrypt a Dutch-prototype RFID passport. In this case, the data exchange between the RFID reader and passport was intercepted, stored, and then the password was cracked later in just 2 hours on a PC giving full access to the digitized fingerprint, photograph, and all other encrypted and plain text data on the RFID tag -- just perfect for slapping together a cloned passport, eh? The flaw, at least in part, is due to the algorithm used when generating the secret key to protect the data. The key turns out to be predictable given that it is sequentially issued and constructed from the passport expiry date, birth date, passport number, and checksum. But don't kick back in superior isolationism just yet kid. Starting October 2006 the US will issue all new passports using the same ISO 14443 RFID tag and Basic Access Control encryption scheme employed by the Dutch e-passports (and others) and adopted by the ICAO as global standards. It's still not clear at what distance the exchange was intercepted -- while the passive ISO 14443 tag is spec'd with a read distance of only 2-milimeters you'll find claims of reads at several meters. This is important 'cause the greater the read distance in say, the line at airport immigration control, the greater the chance of abuse. Regardless, the Dutch e-passport system is still under development allowing for changes, which makes us wonder, is ours? Wouldn't be the first time we've abandoned RFID passport plans due to technology concerns.

Technorati tags: Privacy :: RFID :: Passport

Labels: air travel, airlines, information breaches, rfid

Thanks to Bruce Schneier for leading me to this great RFID Cartoon.

It's funny because it's true.

Labels: humour, information breaches, rfid, schneier

The Saginaw News ran an interesting feature-length article in its Sunday edition about privacy in the retail system. It touches on loyalty programs, RFID, advertising and security of personal information. And it is balanced, with good comments from both business and privacy activists. Check it out: A peek into your privacy: Retailers increasingly ask for personal information.

[Personal Information] :: [Privacy] :: [Retail]

Labels: information breaches, loyalty cards, privacy, retail, rfid

A German group has developed what appears to be the first of its kind: a portable RFID chip zapper that will not damage the article on which the chip is attached. Most methods currently known are microwaving or physically damaging the chip. This method uses a modified disposable camera to deliver a pulse of electromagnetic radiation that likely blows the unit's capacitor. I don't have any expertise to say it will work, but they say it does. See: RFID-Zapper(EN) - 22C3. (Via RFID Gazette.)

[Privacy] :: [RFID]

Labels: information breaches, rfid

Bruce Schneier has a great article at Wired News on the new RFID enabled passports that the US Government is introducing. It chronicles the security problems and the (half way) solutions offered by the US State Department. It is very interesting reading, both for those interested in the actual project and those interested in problems that can arise in projects with privacy issues that require a high level of technical expertise:

Wired News: Fatal Flaw Weakens RFID Passports

"...The State Department has done a great job addressing specific security and privacy concerns, but its lack of technical skills is hurting it. The collision-avoidance ID is just one example of where, apparently, the State Department didn't have enough of the expertise it needed to do this right.

Of course it can fix the problem, but the real issue is how many other problems like this are lurking in the details of its design? We don't know, and I doubt the State Department knows either. The only way to vet its design, and to convince us that RFID is necessary, would be to open it up to public scrutiny.

The State Department's plan to issue RFID passports by October 2006 is both precipitous and risky. It made a mistake designing this behind closed doors. There needs to be some pretty serious quality assurance and testing before deploying this system, and this includes careful security evaluations by independent security experts. Right now the State Department has no intention of doing that; it's already committed to a scheme before knowing if it even works or if it protects privacy."

Labels: information breaches, rfid, schneier

The US State Department has issued its final rules on the implementation of RFID in all US passports, beginning with those issued after October 2006. The chips will include a digitised version of the holder's photo and other information. According to the Washington Post, 98% of the comments on the proposal were against the measure, but the Department suggests that measures are being taken to minimise the risk associated with the RFID chip. The passports will include an "anti-skimming" film on the front and back covers, making it more difficult to read the chip at a distance: U.S. Passports to Receive Electronic Identification Chips.

Labels: information breaches, rfid

The Association for Automatic Identification and Mobility (aka AIM) has released a position paper on RFID privacy and security. It sure has impressed Data Collection Online, which was a little bit breathless in its report on the position paper:

"The position paper, that also includes position statements on other important RFID issues, can be downloaded, at no cost, from the AIM Store from the following link: https://www.aimglobal.org/estore/ProductDetails.aspx?productID=306.

As the professional association representing the full AIM community of providers and end users, AIM Global is uniquely positioned to deliver clear, unbiased, and credible information on auto ID technologies, a broad category of wireless data transmission and data capturing technologies, encompassing RFID."

I haven't read the position paper (more on that below), but I am not sure how you can say that the lobbying group of the RFID industry is "unbiased". Being unbiased suggests being disinterested, which those who make their livelihoods from the products being discussed really aren't. But I digress ...

The document is available for free download from the documents section of the AIM Global website. I didn't download the document, simply because the process to do so involved filling out a huge form that requires information that many would consider intrusive. I just find such forms annoying, since there is no compelling reason given for why the information is necessary. There is no privacy policy and no statement of any kind related to how the information will be used. I am sure that they all mean well, but this registration requirement coupled with no privacy statement significantly undermines whatever their privacy experts have to say on RFID.

Labels: information breaches, rfid

According to MSNBC, Mastercard is planning to introduce RFID, touchless cards into the market beginning with four million cards in the next year. The coverage I've seen doesn't seem to address any of the security risks presented by this technology nor does it say how far away the readers need to be.

I know that I can get through the RFID locks in my office building by brushing my wallet near the sensor. It can read the proximity card through the leather of the wallet and through the cloth of my jacket. I've seen women hold their purses up to the sensor, which can apparently see through the layers of stuff that accumlate in an average purse. I'd think that a payment card reader would be able to read all the cards in my wallet if the sensor was strategically positioned. Interesting stuff, in any evetn .... See: MasterCard plans 4 million 'pay pass' cards - Tech News & Reviews - MSNBC.com.

Labels: information breaches, rfid

The comments sections on this blog are usually pretty quiet, but I've gotten some interesting comments related to California's RFID bill (SB 768), including some made by Paul Nicholas Boylan who was involved with the well publicised "RFID in schools" story. Check them out:

• California RFID bill born again
• San Fran Chronicle wants RFID privacy bill back on the agenda

Labels: information breaches, rfid

The Library Law Blog is reporting that the controvertial California RFID bill (SB 768: Identity Information Protection Act of 2005) is back on the legislative agenda after being shelved: LibraryLaw Blog: Breaking News - California RFID bill born again.

Previous posting: The Canadian Privacy Law Blog: San Fran Chronicle wants RFID privacy bill back on the agenda.

Labels: information breaches, rfid

I blogged yesterday about the shelving of SB 682 in the California legislature (See: The Canadian Privacy Law Blog: California legislature shelves RFID ban). Today, the San Francisco Chronicle has a strong editorial demanding that it be put back on the legislative agenda and urging readers to contact their legislators about it:

FOLLOW-UP / Don't hide this privacy bill:

"... Should the state have the ability to track your movements with tiny radio transmitters? This is the essence of the debate behind Senate Bill 682, which reaches a critical juncture today in the Assembly Appropriations Committee. The bill, authored by Sen. Joe Simitian, D-Palo Alto, would wisely put some restrictions and safeguards on government's use of radio frequency identification (RFID) technology. Simitian's bill was inspired by the controversy that erupted when middle-school students in Sutter County were required to wear badges that allowed the school to track their movements around campus. The school board last year scrapped the experimental program in the face of parental objections, but the implications of expanded government use of this technology are truly chilling."

Labels: information breaches, rfid

A California senate committee has shelved SB 682, also known as the Identity Information Protection Act of 2005., until the next session. The bill would have outlawed embedding wireless identification technology (read: RFID) in state-issued documents, such as drivers' licenses. The bill had been supported by the ACLU, the EFF and the Privacy Rights Clearinghouse but had been opposed by a number of industry groups. According to ZDNet, the industry groups won out, resulting in the bill being shelved. See California shelves RFID ban | Tech News on ZDNet.

Labels: information breaches, rfid

The overseer of privacy in Italy has advised municipalities in that country that requiring the use of transparent garbage bags is a violation of privacy, as it could unduly expose personal information. The municipalities had required see-through bags to make sure citizens are following sorting guidelines:

WATCHDOG FOR PRIVACY: TRANSPARENT BIN BAGS 'OUTLAWED' :

"(AGI) - Rome, Italy, Jul 22 - The obligation set by some municipalities for citizens to use transparent or with labels for 'door-to-door' garbage collection bin bags involve a breach of privacy. Instead it is allowed to have bags with bar codes, microchips or 'intelligent labels' (RFID). No to indiscriminate controls, but bags can be inspected only in cases in which the citizen who did not respect the sorting of household waste is not identifiable in any other way. With a general measure, proposed by Giuseppe Fortunato, the Watchdog for Privacy replied to questions of local authorities and many complaints and citizen's warnings who lamented a possible violation of privacy, deriving especially by the method of garbage collection and administrative controls, regarding personal data observed through the bags themselves or inspecting their contents. There are, in fact, many personal belongings (mail, phone bills, bank statements) that end up in rubbish, sometimes also regarding health (medicine, prescriptions, etc.) or political, religious or union memberships. This information, if not treated fairly, or if abused, can involve serious inconveniences to people. The Watchdog observed that the sorting of household waste, expected by specific norms, is in the public interest, but did not consider the obligation placed by some local authorities to use transparent bags for the 'door-to-door' collection fair, as anyone can easily see the contents. The norm involving labels with the name and address of the owner of the garbage, especially if left on the street, also involve a violation of privacy. (AGI)"

Labels: health information, information breaches, rfid

 Privacy Violation in Italian Media Giant - tagging employees with Rfid chips since last December

Privacy Violation in Italian Media Giant.  orzetto writes  "Italian newspaper La Repubblica is reporting that Silvio Berlusconi's company, Mediaset (that owns three of the six main TV stations in Italy), has been tagging employees with Rfid chips since last December (for English version, ask the fish).

The chips would allegedly be able to track the movements of any worker, even if Mediaset spokesmen say it's only to automatically open some doors to authorized personnel only and such things. Trade unionists from CGIL have reported the company's behaviour to the authorities, as it would be in violation of the Italian workers' charter (again, fish). This would probably be small news (yet another bad employer) if Silvio Berlusconi were not the Italian Prime Minister, violating the same laws he should enforce."  [Slashdot: Your Rights Online]

Labels: information breaches, rfid

Discussion of RFID enabled passports has been going on for some time in the privacy community, but it is starting to hit the mainstream press:

Yahoo! News - Privacy Advocates Criticize Plan To Embed ID Chips in Passports:

"... State Department officials said the chips are part of a global effort to prevent passport fraud. Each chip will contain a digital record of all information printed on the passport, including the holder's name and document number. The chip will also contain the passport holder's photograph, enhanced by facial recognition technology. That way, even if the paper passport is altered, customs agents would be able to compare the information on the chip with the person presenting it....

"If you're walking around in Beirut, it would be well worth Al Qaeda's money to use one of these readers to pick out the Americans from the Swedes without any problem," said Barry Steinhardt, director of the American Civil Liberties Union's technology and liberty program...."

Labels: information breaches, rfid

RAND has released an interesting report on the use of RFID in the workplace. While the future and potential uses of RFID has gotten a lot of press lately, not much discussion has taken place about the thousands of companies that are currently using the technology for controlling access to buildings. Few companies have policies about how the information collected will be used and how long it will be maintained. In short, companies need to give this matter some thought, document their practices and let their employees know about it.

RAND | Privacy in the Workplace: Case Studies on the Use of Radio Frequency Identification in Access Cards:

"Companies use RFID workplace access cards to do more than just open doors (e.g., for enforcing rules governing workplace conduct). Explicit, written policies about how such cards are used generally do not exist, and employees are not told about whatever policies are being followed. Using such systems has modified the traditional balance of personal convenience, workplace safety and security, and individual privacy, leading to the loss of "practical obscurity." Such systems also raise challenges for the meaning and implementation of fair information practices."

Thanks to the Surpriv blog for the link: Surpriv: RFID Surveillance and Privacy: RAND Study of RFID Access Badge Data Policies and Practices.

Labels: information breaches, rfid, surveillance

The Department of Homeland Security is learning that RFID has negative connotations. According to Wired News, they're trying to rename them, at least in their cards:

Wired News: RFID Cards Get Spin Treatment:

"... The distinction is part of an effort by the Department of Homeland Security and one of its RFID suppliers, Philips Semiconductors, to brand RFID tags in identification documents as 'proximity chips,' 'contactless chips' or 'contactless integrated circuits' -- anything but 'RFID.' ..."

I suppose they didn't want to call them "auto id chips" or "spy chips".

Labels: homeland security, information breaches, rfid

David Canton's regular column in the London Free Press is about the insecurity of databases that are used to establish identity and government initiatives to make ID more secure:

London Free Press: Business Section - Non-secure ID database scary prospect:

"After the terrorist attacks of Sept. 11, 2001, governments began looking for solutions to identification problems that had plagued them for decades. The United Kingdom and the United States suggested introducing national identification cards and driver's licences respectively with 'smart card' radio frequency identification (RFID) technologies. Canada has also considered the idea...."

Labels: information breaches, rfid

Labels: information breaches, rfid

The National Institute of Standards and Technology has relaxed some of its previous requirements in implementing the new federal ID standards for US government employees and contractors. The amount of information to be collected and stored on the RFID card has been scaled back. RFID tracking has been addressed by requiring that cards be stored in an "electronically opaque sleeve" when not in use.

Common ID standards relax some requirements:

Bush administration officials in charge of beefing up security for government-issued identification cards relaxed some technical requirements and enhanced some privacy measures to address critics of the draft standards...."

The new standards are at http://csrc.nist.gov/publications/fips/fips201/FIPS-201-022505.pdf

Labels: information breaches, rfid

The RFID Journal is carrying an article by Dr. Reuven R. Levary (a Professor of Decision Sciences, Cook school of Business) and three JD/MBA students from Saint Louis University on the legal and privacy aspects of RFID technology:

RFID Journal - RFID, Electronic Eavesdropping and the Law:

"Feb. 14, 2005--As radio frequency identification enters the mainstream, consumer advocates are raising concerns about the potential use of the technology for electronic eavesdropping. In Europe, there are strong laws governing the use of data gathered on consumer. In the United States, no such overarching legislation exists. So the question is: What laws currently on the books, if any, in the United States could protect consumers against invasion of privacy using RFID systems? And what are the legal ramifications for companies that use the technology in a retail setting?. ..."

Labels: information breaches, rfid

A rural school in the US is planning to make their students wear RFID-embeded tags to track their movements. As a client of mine just mentioned to me, "Is this to get them used to being surveilled while they're young?"

Yahoo! News - Parents Protest Student Computer ID Tags:

"SUTTER, Calif. - The only grade school in this rural town is requiring students to wear radio frequency identification badges that can track their every move. Some parents are outraged, fearing it will take away their children's privacy. ..."

Labels: information breaches, rfid

IT Business has an article by Ian Palmer with an overview of many of the projects being funded by the Office of the Privacy Commissioner's contributions program: Privacy research to analyze ID theft, RFID, surveillance. (See also PIPEDA and Canadian Privacy Law: OPC announces recipients of special research funding.)

Labels: information breaches, privacy, rfid, surveillance

The New York Times is reporting that a group of researchers have managed to crack the most prevalent impelementation of RFID as a security device. They can read your chip/card while standing next to you in the elevator, crack the keys and, less than an hour later, replicate your chip or card.

While the threat remains theoretical, this has significant repurcussions for owners of vehicles that use RFID immobilizers, pay-at-the-pump systems and facilities that use RFID access cards. See: The New York Times > Science > Students Find Hole in Car Security Systems. See also a discussion at Slashdot: Slashdot Mobil SpeedPass, Various Car RFID Car Keys Cracked

Update: The full articled on how it was done is available here:

RFIDAnalysis.org:

"The Texas Instruments DST tag is a cryptographically enabled RFID transponder used in several wide-scale systems including vehicle imobilizers and the ExxonMobil SpeedPass system. This page serves as an overview of our successful attacks on DST enabled systems. A preliminary version of the full academic paper describing our attacks in detail is also available below. "

Labels: cardsystems, information breaches, rfid

Consumer and privacy groups are upset at the use of RFID chips by UK retailer, Tesco: BBC NEWS | Business | Tesco 'spychips' anger consumers

Labels: information breaches, rfid

The following link was sent by a regular correspondent ...

Bearing in mind that rumours are rumours, this one is rather interesting and perhaps chilling:

New rumours about spy chips in Euro notes | EDRI: "

There is a renewed rumour that the European Central Bank is going to add spy chips (RFIDs) to Euro banknotes. 'Czerwensky intern', a German newsletter providing bank and insurance background reports, says the ECB might have already signed contracts with Hitachi, and is ready to introduce the spy-notes this year. Allegedly, the contract requires such a high volume of RFIDs that Hitachi can't deliver all chips itself, but has to rely on subcontractors.

Earlier rumours (dating back to 2001) about plans to track and trace all Euro notes with the help of RFIDs were strongly denied by the ECB. On 4 June 2003 EDRI-gram reported about a press release from Hitachi announcing negotiations about the contract to Japanese investors. The RFIDs in euro banknotes could help against counterfeiting and make it possible to detect money hidden in suitcases at airports. But the technology would also enable a mugger to check if a victim has given all of his money. If RFIDs are embedded in banknotes, governments and law enforcement agencies can literally 'follow the money' in every transaction. The anonymity that cash affords in consumer transactions would be eliminated.

According to the biannual report from the ECB on the counterfeiting of the euro, released on 13 January 2005, the amount of counterfeited euro banknotes is still very low. It has risen 8% compared to 2003, "but the recent trend has been downwards."..."

Labels: air travel, airlines, information breaches, rfid

Thanks to PrivacySpot for pointing me to the intersting article in Wired on the upcoming privacy fights of 2005:

Privacy Battles of 2005 | PrivacySpot.com - Privacy Law and Data Protection:

"Wired is running a nice article about the upcoming privacy fights of 2005. President Bush has plans to expand federal powers under the Patriot Act. Whether that involves passing Patriot II or pushing provisions through piecemeal remains to be seen. What is evident, though, is that privacy advocates have cause for concern. Unfortunately, the SAFE Act, which seeks to counteract some of Patriot's more onerous provisions, is languishing in the House and Senate floors. Also on the horizon as battles over national ID cards, DNA databases, states' rights in passing privacy legislation, and the ubiquitous RFID tags. It promises to be an interesting year, as privacy battles escalate because of two factors: increased demands for privacy restrictions due to terrorism, and the rapid elimination of formerly insurmountable technological barriers."

Labels: information breaches, patriot act, rfid

Derren Bibby, at CRM Buyer, has written a very good article on implementing retail RFID in a privacy friendly way. In short, retailers must be transparent about what they are doing and must disable the chips at the door:

INDUSTRY INSIDER: Squaring the Circle with RFID and Privacy

With RFID, while the customer will benefit from a long list of store efficiency improvements, there will be some who will feel uncomfortable with the prospect of a retailer gaining the ability to peer into their shopping baskets to discover exactly what they are carrying.

Labels: information breaches, rfid

Privacy International and the Electronic Privacy Information Center have recently released their seventh annual Privacy and Human Rights Survey, which details global threats to privacy and related civil rights. It particularly highlights the increasing surveillance of citizens and intrusive uses of technology in the battle against terrorism.

From the joint EPIC/PI press release:

Privacy International & EPIC Release Annual Global Privacy Study

17/11/2004

GLOBAL HUMAN RIGHTS STUDY WARNS OF ENDEMIC PRIVACY THREATS

Major report sets out government surveillance strategies

17th November 2004

A major international privacy report published today has concluded that governments across the world have substantially increased surveillance in the past year. The report warns that threats to personal privacy have reached a level that is dangerous to fundamental human rights.

The 7th annual Privacy and Human Rights survey, published by Privacy International & the US based Electronic Privacy Information Center (EPIC) reviews the state of privacy in sixty countries and warns that invasions of privacy across the world has increased significantly in the past twelve months. The 800 page report is available free of charge at http://www.privacyinternational.org/survey/phr2004

The report paints a bleak picture of the erosion of the right to privacy, particularly since the September 11th attacks in the United States. It observed: that crime and public order laws passed in recent years have placed substantial limitations on numerous rights, including freedom of assembly, privacy, freedom of movement, the right of silence, and freedom of speech. Governments have continued to use terrorism as the pretext for an increase of surveillance, even when surveillance is unwarranted.

The report identifies a trend across the world toward mass surveillance of the general population, and cited a catalogue of illegal spying and surveillance activities by government agencies.

In response to calls for increased security many countries have pursued policy and legislative efforts that aim at implementing identification schemes, expanding the surveillance of communications for law enforcement and national security agencies, weakening data protection regimes, and intensifying data sharing and collection practices - all made possible by a growing cooperation between government entities and the private sector.

The report singles out a number of trends:

• New identification measures and new traveller pre-screening and profiling systems
• New anti-terrorism laws and governmental measures provide for increased search capabilities and sharing of information among law enforcement authorities
• Increased video surveillance
• DNA and health information databases
• Censorship measures
• Radio frequency identification technologies
• New electronic voting technologies
• Mismanagement of personal data and major data leaks

Privacy International's Director, Simon Davies, said the report highlighted a 'disturbing' trend toward greater state power. 'Governments are systematically removing the right to privacy. Surveillance of every type is being instituted throughout society without any thought about the need for safeguards.'

'The spectre of terrorism has at last become the device that any government can deploy to entrench the powers they always sought. The situation has become a dangerous farce,' he added.

'Governments are joining together their data systems. They are sharing information to a greater extent each year with the private sector. And they are cooperating unquestioningly with other governments to exchange vast reserves of personal information. This situation cannot continue without imperilling the right to privacy', said Mr Davies.

On a more upbeat note, the report did identify positive counter-trends:

'Invasions of privacy were met in various countries with forceful reactions from human rights groups. In Germany, outcry against a retail chain's use of RFID tags unbeknownst to its customers led to the halt to the company's projects. In Greece, the data protection authority struck down the use of biometric identity verification in airports because the collection of personal information through RFID tags exceeded its purpose. In Malaysia, the Bar Council criticized the security and privacy risks of Mykad, the multi-purpose smart card, which forced the government to work on a legislation to answer such concerns. In Poland, the Constitutional Tribunal held unconstitutional a law that allowed police officers to observe and record events in public places. Public interest groups had opposed the law alleging that it violated the right to privacy enshrined in the Polish Constitution. In Sweden, the privacy commissioner forbade a school's fingerprint recognition program. In Ukraine, a new law that restricts access to information was strongly opposed by several NGOs and international organizations because of its violation of the Constitution and global freedom of information standards. In reaction, amendments were introduced that improve the final version of the law.'

Labels: air travel, airlines, cardsystems, health information, information breaches, rfid, surveillance, video surveillance