Surpriv: RFID Surveillance and Privacy

http://eprint.iacr.org/2006/054

Abstract. Radio-Frequency Identifier (RFID) technology, using the ISO-14443 standard, is becoming increasingly popular, with applications like credit-cards, national-ID cards, E-passports, and physical access control. The security of such applications is clearly critical. A key feature of RFID-based systems is their very short range: Typical systems are designed to operate at a range of 5-10cm. Despite this very short nominal range, Kfir and Wool predicted that a rogue device can communicate with an ISO-14443 RFID tag from a distance of 40-50cm, based on modeling and simulations. Moreover, they claimed that such a device can be made portable, with low power requirements, and can be built very cheaply. Such a device can be used as a stand-alone RFID skimmer, to surreptitiously read the contents of simple RFID tags. The same device can be as the “leech'’ part of a relay-attack system, by which an attacker can make purchases using a victim’s RFID-enhanced credit card—despite any cryptographic protocols that may be used.

We conclude that (a) ISO-14443 RFID tags can be skimmed from a distance that does not require the attacker to touch the victim; (b) Simple RFID tags, that respond to any reader, are immediately vulnerable to skimming; and (c) We are about half-way toward a full-blown implementation of a relay-attack.

An award for wireless sensor research: CRI: Infrastructure for Networked Sensor Information Technology:

This project, developing a series of sensor networking testbeds in New Mexico, focuses on the use of wireless sensor networks in the following applications:

-Tracking, controlling, and behavioral monitoring of livestock on rangeland, -Micro-monitoring of weather and climate on an ecological research site, -Protecting contextual privacy of distributed sensing tasks, -Developing component-based middleware engineering for embedded sensor nodes and gateways, -Creating an integrated sensor net design environment and testbed, and -Developing a real-time collaborative virtual environment for smart office design and distance learning.

Establishing infrastructure, core capabilities, and expertise in Wireless Sensor Networks (WSN) and Distributed Sensor Information Technology, the project services three specific research projects:

-Privacy protection issues in distributed sensing, -Component-based middleware engineering for WSN, and -Integrated sensor net design environment and testbed.

The equipment requested includes different types of embedded processor-radio modules (motes), compatible sensor data acquisition modules, serial and Ethernet programming and interface boards, and embedded specialized gateway computers.

Broader Impact: Newly developed courses on sensor networks service students at many levels, strengthening the education at this minority serving university. Furthermore, the research projects offer benefit to society directly and indirectly. Improved methods for integrating distance learning with main-campus learning attracts and engages more students in higher education; improved understanding of rangeland usage and livestock behavior helps improve land utilization and food production for society; and improved understanding of sensor network privacy security issues and of software engineering for sensors helps further the deployability mission-critical areas.

There is a call for papers out for a workshop to be held in conjunction with the International Conference on Emerging Trends in Information and Communication Security (ETRICS’06), June 6-9, 2006, Freiburg, German, entitled, “2006 Workshop on UC and RFID Today – Breakthrough or Still on Hold?” http://www.etrics.org/workshop_uart.php

In a letter to the editor, California State Senator Simitian responds to an op-ed urging no legislated restrictions on RFID for IDs in California:

Privacy safeguards

Editor — Regarding “Fearing bits that don’t bite” (Sept. 22): I was bemused that an industry lobbyist would suggest that anyone who wants to protect privacy is hostile to change. That’s certainly not the view of seven of California’s largest newspapers, including The Chronicle, that have supported SB768.

I agree, of course, that RFID technology can be put to many good uses; but that’s not the question raised by SB768. The bill addresses a tougher question: Should state and local governments compel you to carry a government identification document that broadcasts your personal information?

In response to that question the bill does three things: (1) makes it unlawful to “read” your personal information without your knowledge; (2) establishes basic privacy and security safeguards to prevent unauthorized data-reading; and (3) requires the government to take a three-year timeout before embedding RFID in government-issued “mass distribution” documents such as driver’s licenses.

Industry opponents would do well to remember that public acceptance and commercial success of developing technologies require that we acknowledge and address legitimate privacy and security concerns, not ignore or deny them.

State Sen. JOE SIMITIAN

Palo Alto

Op-ed on RFID by Tim Heffernan, director of government relations and public affairs at Symbol Technologies and vice chair for the RFID working group of the Information Technology Industry Council.

“Afraid of its repercussions, China in the late 1990s severely restricted access to the Internet. With Senate Bill 768, state Sen. Joe Simitian, D-Palo Alto, is attempting to do something similar by restraining radio frequency identification — RFID — under the pretense of protecting ID privacy. The real reason for this bill is because the senator fears the same thing China did: change…”

NSF award to the University of Washington, for investigation of an “RFID ecosystem”:

https://www.fastlane.nsf.gov/servlet/showaward?award=0454394

Title : CRI: RFID Ecosystem
Type : Award
NSF Org : CNS
Latest Amendment Date : August 29, 2005
File : a0454394

Award Number: 0454394
Award Instr.: Continuing grant
Prgm Manager: Stephen R. Mahaney
CNS DIVISION OF COMPUTER AND NETWORK SYSTEMS
CSE DIRECT FOR COMPUTER & INFO SCIE & ENGINR
Start Date : September 1, 2005
Expires : August 31, 2006 (Estimated)
Expected
Total Amt. : $99,946 (Estimated)
Investigator: David L. Kaplan davek@cs.washington.edu (Principal Investigator current)
Edward D. Lazowska (Co-Principal Investigator current)
Gaetano Borriello (Co-Principal Investigator current)
Christopher J. Diorio (Co-Principal Investigator current)
Sponsor : U of Washington
1100 NE 45th St, Suite 300
Seattle, WA 981050000 206/543-4043

NSF Program : 7359 COMPUTING RES INFRASTRUCTURE
Fld Applictn: 0000912 Computer Science
Program Ref : 9218,HPCC,
Abstract :

ABSTRACT

Proposal: CNS 0454394 PI: Kaplan, David L. CoPIs: Gaetano Borriello, Christopher J. Diorio, Edward D. Lazowska Institution: University of Washington Title: CRI: RFID Ecosystem Program: NSF 04-588 CISE Computing Research Infrastructure

This project will explore applications for RFID tags in homes and workplaces rather than previously studied applications for product supply-chains. Applications relevant to the workplace and home will be explored that will integrate RFID capabilities with other ubiquitous computing technologies. Systems issues to be explored include: innovative RFID tags with additional sensing, middleware and operating-system support for sensing/actuation events, database organization based on distributed data on servers and tags, mining of sensing/actuation events to infer users activities, and ubiquitous computing applications for the workplace. These technologies have deep privacy, legal, social, and policy implications. The project will incorporate researchers in both technology and social aspects of technology. Broader impacts of this project include potential applications, and use in education and design projects at the University of Washington.

A $200K NSF award to study giving migratory birds little birdie cell phones… a clever hack, if it works, making use of existing infrastructure to overlay new collection networks; akin to this use of cell traffic patterns to map road congestion.

https://www.fastlane.nsf.gov/servlet/showaward?award=0454822

Title : A Miniature Micropower Cell Phone for Tracking Migratory Animals
Type : Award
NSF Org : DBI
Latest Amendment Date : August 25, 2005
File : a0454822

Award Number: 0454822
Award Instr.: Continuing grant
Prgm Manager: Gerald Selzer
DBI DIV OF BIOLOGICAL INFRASTRUCTURE
BIO DIRECT FOR BIOLOGICAL SCIENCES
Start Date : August 15, 2005
Expires : July 31, 2006 (Estimated)
Expected
Total Amt. : $ (Estimated)
Investigator: William D. Robinson douglas.robinson@oregonstate.edu (Principal Investigator current)
Terri S. Fiez (Co-Principal Investigator current)
Huaping Liu (Co-Principal Investigator current)
Zhongfeng Wang (Co-Principal Investigator current)
Kartikeya Mayaram (Co-Principal Investigator current)
Sponsor : Oregon State University
312 Kerr Administration
Corvallis, OR 973312140 541/737-4933

NSF Program : 1108 INSTRUMENTAT & INSTRUMENT DEVP
Fld Applictn:
Program Ref : 7468,9184,BIOT,
Abstract :

This award supports the development of a miniature radio tag capable of communicating with cell tower receivers normally used by cellular phones. The device is essentially a stripped-down version of a cell phone with low enough mass (2 grams) to permit its attachment to migratory birds or other small animals. To conserve power, a timer in the unit will keep it dormant until preprogrammed dates when the transmitter will activate and attempt to make contact with a nearby cell phone tower. Because the device will remain off during an extended period, and then activate for only long enough to make contact with the nearest receiver, a tiny battery is expected to provide sufficient power for several contacts over a period as long as 2 years. Each unit will communicate a unique identifying number, so that individual tagged birds can be linked to a specific location. Following the contact, the PI will receive notification of the tag identity and location from the cellular network provider by email. The tag will be useful in studies of migration and dispersal, both of which are nearly universal behaviors among animals, particularly birds. Despite their importance, the impact of these behaviors on population dynamics remain major unanswered questions in biology, in large part because of our inability to track Individual animals throughout their annual cycle. The strategy is expected to locate birds to within a 5 km radius, a completely unprecedented level of precision for locating individual small migratory animals. The project is a collaboration of ecologists and electrical engineering researchers that will involve undergraduate and graduate students in collaborative learning opportunities, including both design and field testing of the instrument.

AIM Global has very courteously run an essay of mine as a guest editorial, entitled, “Privacy Invasion as ROI”

It was something of a response to an article of theirs, of last year, “The ROI of Privacy Invasion,” which suggested that it would never be worth the government’s spending the money to create a “Big Brother” surveillance system; my view is that what we’ll see is a lot of commercial investments for plain old commercial interests, but at a certain point, the pervasiveness of RFID readers, and readable things, makes it both easy and cost-effective (i.e., it’ll be an additional return on all that investment) to create surveillance systems too.

MSNBC on lobbying to avert a ban on use of RFID in identity documents in California: http://msnbc.msn.com/id/9038305/

State Sen. Joe Simitian, D-Palo Alto, has introduced first-in-the-nation legislation that would ban for three years the use of government IDs that could be used to track the movement of California residents.

The bill, called the Identity Information Protection Act of 2005, would make it a misdemeanor to illegally obtain information from an RFID card — a process called skimming. It also would require what tech lobbyists call a high level of security for government-issued RFID cards and require any agency issuing RFID cards to tell users annually where the card readers for the devices are located.

“This bill is very accepting of the technology, but it admits that there are legitimate privacy concerns,” says Mr. Simitian.