http://www.le.state.ut.us/~2004/status/hbillsta/HB0251.htm

http://www.rfidbuzz.com/news/2004/utah_no_right_to_know.html

http://www.spychips.com/aimletter.html

The AIM “RFID FAQs, not Fiction” produced by the so called “AIM RFID Privacy Work Group”

http://www.aimglobal.org/technologies/rfid/rfid_faqs.asp

is also full of errors or misrepresentations:

e.g. they mistakenly claim radio frequency hopping as a security measure, when, in fact, just as with GSM mobile phones, the feature is more to deal with interference and reflected signals. An attacker does not have to build their own frequency hopping radio, they just need to buy or steal an EPC compliant reader.

They claim correctly that passive RFID tags do not emit much Radio Frequency energy and so are not a health risk, but they neglect to think about the effect on say shop staff exposed to dozens or hundreds of Readers on Smart Shelves or at every checkout till day in, day out.

“Currently, a court subpoena is required to use private information such as cell phone records and credit card purchases. This information is strictly for use in criminal activities investigations” – no such court order is required in the UK, and in many other countries. The UK tax authorities have already asked for and have been given supermarket loyalty card data.

They neglect the “third party cookie” type RFID tag profiling possabilities, by claiming that other retailers will not be able to read any RFID tags that you are carrying or which are in your clothing.

They claim that RFID tags cannot be duplicated – it is probably not cost effective to do so, but their responses to readers can be faked or simulated as shown by the RSA Labs “blocker tag”:

http://www.spy.org.uk/spyblog/archives/000206.html

http://www.epcglobalinc.com/standards_technology/specifications.html

The likelyhood of consumers checking the movements of pallets or containers full of goods remotely by radio is small, but the likelyhood of spies tracking military supplies is not.

The “kill” capability which has been promised, but not yet implemented in any of the item level trials in supermarkets etc. would, under the current standards not be suitable for military use – a *24bit* “kill” code in 13.56MHz HF tags is very weak, but the *8 bit* “kill” code in the potentially longer range UHF (around the 900MHz cell phone frequency) tags is *trivially* weak i.e. only 255 possible variants.

There are hints about the as yet unpublished Class 1 version 2 specifications which will combine the HF and UHF standards, but there seems to be no proper strong cryptographic authentication handshake planned for this standard either.

Until RFID tags which are much more secure and complicated (and therefore more expensive) than the current “to stupid to kill” smart labels or the the proposed Class 1 tags, are actually cheap enough to deploy en masse, then all the individual consumer item privacy worries will remain, as well as the distinct possability of espionage and sabotage of the military logistics chain, if it relies on this technology.

The pizza delivery type “intelligence leaks therough civilian activity” problem will still remain, even if the military deploys more complicated, more expensive RFID tags.

The *first* RFID tags that the military should deploy is to upgrade the original “Identify Friend or Foe” transponder technology, out of which RFID developed, which has failed to prevent “Friendly Fire” casualties in the recent wars in Iraq and Afghanistan.

I wonder if fear of evoking privacy concerns hasn’t been the largest argument against, and as those concerns come up any way, with the appearance of RFID, there’ll be less reluctance to test the waters.

I actually prefer to use my BofA business check card in my business work, because it records a detailed transaction log into my bank statements, with more information on the purchases than I get from my credit card statements.

Or will the database records proving that you bought individual food products from a particular supermarket magically disappear once the litigation lawyers scent money ?

c.f.

http://www.rfidprivacy.org/blog/archives/000079.html