The Inherent Danger of Radio IDing Children
In recent months, the US government looked into the possibility of putting active RFID tags into all US passports. Fortunately, this program appears to be a no go. But now, apparel maker Lauren Scott California is beginning to put active RFID tags into children's sleepwear that should be headed for retail outlets around Christmas of this year, according to Information Week magazine.
Now, a little background on RFID. There are two types of RFID tags in general, active and passive. Passive tags are simple and cheap. They are roughly analagous to barcodes. You must get incredibly close to them and blast them with a burst of energy in order to get them to "reflect" a signal that identifies one tag from another. Active RFID tags are quite different and contain their own power source and broadcast their identification sometimes over very short distances but potentially over extremely long distances. The real distance is a factor of the design of the tag as well as the reading device.
Lauren Scott California is going to be putting active RFID tags into chilren's sleepwear using a solution from SmartWear Technologies Inc. The idea, as claimed by the clothing manufacturer, is to give parent's the ability to know that their children are safe in their homes by purchasing a $500 monitoring package that will tell them that their children are still in their bedrooms. This, however, is not what a technology like this does at all. What will actually be told to the parents by this monitoring system is that their children's clothing is still in the room and will give parents a false sense of security.
The harsh reality of putting an active RFID tag into children's clothing is that anyone can get an RFID reader, or even make one themselves. And with active tags that, in this case, broadcast location and identification information 30 feet in every direction, a potential kidnapper can sit outside of the house (or place an RFID reader there so that they only need appear in person to actually commit the crime) and know exactly where the child is without ever having to peer into a window and make his or her presence known. And then, knowing that the parents believe the child to be safe can take off with the child leaving the RFID sleepwear behind in the bed giving the kidnapper an eight hour head-start on authorities as most parents won't check in until morning.
To make matter worse, SmartWear is working to come up with newer technology that will allow the garments to broadcast for closer to 600 feet! This is a far enough distance that kidnappers could monitor multiple homes at once or even monitor a child's movements from another building. SmartWear hopes to increase the use of these RFID tags for use in military and law enforcement uniforms. Imagine the glee of high tech criminals once they are able to detect the approach and identification of police coming to nap them! Always being able to stay one step ahead of the police because you know exactly where they are at all times. The implications of IDing humans is enormous.
And, if that wasn't enough, SmartWear is planning to implement a child database that will carry detailed information about each child (through a voluntary system with parents sending in the information, of course) that will be made available to law enforcement agencies, Amber Alert or potentially other companies. The real concern here is, if this company is already willing to make your child a top target for kidnapping, how much effort are they really going to put into securing this database? Sure, they might do a wonderful job and it might never be hacked. And they might never share that information with anyone inappropriate. And all of those people that they share the list with might likewise protect it with the utmost of security. Or, it might be hacked in the first week and all of the information about children including their tag ID's, addresses, names, ages, sex, etc. will be available for potential child slavery rings in a a nice convenient format with hooks into the ID tags so that kidnappers can look up the child that they are about to kidnap on their laptop and make sure that they fit a high profit profile. Few ideas have more potential for horrific failures like this one does.
This follows on the heels of a high school that decided to require students to carry active RFID ID badges in order to enter their high school. Fortunately, the danger of the situation was realized before any students were actually hurt because of the program. What was happening was this: since students had to have active RFID tags in order to enter the school, that meant that they must also carry the tags with them as they travelled to and from the school. Because the tags were active, they were broadcasting the indentification and location of each of the students. Because all students had to have them, the system could even be used to identify students as being in a group or travelling individually. Since the tags were active, they could also be used to find student's homes, in theory, although this would be extremely difficult but very much in the realm of possibility.
The greatest fear to arise from this program was that of the many students who would travel, on foot, past wooded areas of town where there was very low visibility. Using an RFID reader, a potential abductor could, over a period of days, identify students that he was interested in abducting. Then, while hiding in the cover of the woods, could utilize RFID to determine when the student that he was after had been left alone by other students. The ease of abducting student during their travels to and from school was at an all time high. Imagine when parents realized that their students safety was at high risk and that the system had no security advantages over far cheaper and simpler solutions like barcoding or mag-striping. Someone in the district likely thought that RFID was "hot" and that a system like this would be a ticket to a promotion. As adults we need to be aware of the dangers of broadcasting the identity and location of our children. Any technology that uses radio frequency can be seen by anyone using extremely low cost equipment.
Another example, fortunately not involving children, that did end in disaster was that of a government agency in Mexico City. This certain Mexican government agency decided that in order to be absolutely sure that only autorized personnel were able to gain access to their office building that they would have active RFID tags inserted under the skin of their employees. At first, this sounded like a great idea, at least to those who did not have to have the surgery performed on themselves. However, it took very little time before the problems of a system such as this began coming to light.
Criminals seeking to gain entrance to the department found that they were able to frequent the local bars, restaurants and coffee shops and were able to identify department personnel from their RFID broadcasts. Using this system they would also have been able to learn their break patterns, clothing, hair styles and other information necessary to impersonate someone. Then, they were able to make their own matching RFID tags that they could simply slip into their pockets. Using their RFID readers they would then determine when a person had definitely left the government building and had entered a restaurant or bar and then would enter the building themselves. There were security guards in place who would look at the badges and, one would hope, would recognize the people that they saw every day. But, because of the false sense of security providing by an RFID system, the guards stopped checking people as carefully and criminals were able to easily come and go in the buildings with the sense of security of knowing that at least THEY were aware of the movements of the people that they were attempting to impersonate and could be sure that they had not tried to re-enter the building yet.
The bottom line in RFID is that the use of active tags is great for items like palettes of canned goods, dorm refridgerators, car parts, etc. They are great for tracking all kinds of objects. But when it comes to tracking people, active RFID is extremely dangerous. There is a reason why, in the past, only seriously dangerous criminals were ever tagged with a system such as this. Only criminals dangerous enough that the public deemed their safety of little concern. We should hardly treat our children in the same way. These were systems not designed to protect criminals from the public but to protect the public from the criminals. Tagging children or children's clothing is hardly going to protect any adults on a cold night in a dark alley from being jumped by four year olds looking for a wallet and car keys.
Now, a little background on RFID. There are two types of RFID tags in general, active and passive. Passive tags are simple and cheap. They are roughly analagous to barcodes. You must get incredibly close to them and blast them with a burst of energy in order to get them to "reflect" a signal that identifies one tag from another. Active RFID tags are quite different and contain their own power source and broadcast their identification sometimes over very short distances but potentially over extremely long distances. The real distance is a factor of the design of the tag as well as the reading device.
Lauren Scott California is going to be putting active RFID tags into chilren's sleepwear using a solution from SmartWear Technologies Inc. The idea, as claimed by the clothing manufacturer, is to give parent's the ability to know that their children are safe in their homes by purchasing a $500 monitoring package that will tell them that their children are still in their bedrooms. This, however, is not what a technology like this does at all. What will actually be told to the parents by this monitoring system is that their children's clothing is still in the room and will give parents a false sense of security.
The harsh reality of putting an active RFID tag into children's clothing is that anyone can get an RFID reader, or even make one themselves. And with active tags that, in this case, broadcast location and identification information 30 feet in every direction, a potential kidnapper can sit outside of the house (or place an RFID reader there so that they only need appear in person to actually commit the crime) and know exactly where the child is without ever having to peer into a window and make his or her presence known. And then, knowing that the parents believe the child to be safe can take off with the child leaving the RFID sleepwear behind in the bed giving the kidnapper an eight hour head-start on authorities as most parents won't check in until morning.
To make matter worse, SmartWear is working to come up with newer technology that will allow the garments to broadcast for closer to 600 feet! This is a far enough distance that kidnappers could monitor multiple homes at once or even monitor a child's movements from another building. SmartWear hopes to increase the use of these RFID tags for use in military and law enforcement uniforms. Imagine the glee of high tech criminals once they are able to detect the approach and identification of police coming to nap them! Always being able to stay one step ahead of the police because you know exactly where they are at all times. The implications of IDing humans is enormous.
And, if that wasn't enough, SmartWear is planning to implement a child database that will carry detailed information about each child (through a voluntary system with parents sending in the information, of course) that will be made available to law enforcement agencies, Amber Alert or potentially other companies. The real concern here is, if this company is already willing to make your child a top target for kidnapping, how much effort are they really going to put into securing this database? Sure, they might do a wonderful job and it might never be hacked. And they might never share that information with anyone inappropriate. And all of those people that they share the list with might likewise protect it with the utmost of security. Or, it might be hacked in the first week and all of the information about children including their tag ID's, addresses, names, ages, sex, etc. will be available for potential child slavery rings in a a nice convenient format with hooks into the ID tags so that kidnappers can look up the child that they are about to kidnap on their laptop and make sure that they fit a high profit profile. Few ideas have more potential for horrific failures like this one does.
This follows on the heels of a high school that decided to require students to carry active RFID ID badges in order to enter their high school. Fortunately, the danger of the situation was realized before any students were actually hurt because of the program. What was happening was this: since students had to have active RFID tags in order to enter the school, that meant that they must also carry the tags with them as they travelled to and from the school. Because the tags were active, they were broadcasting the indentification and location of each of the students. Because all students had to have them, the system could even be used to identify students as being in a group or travelling individually. Since the tags were active, they could also be used to find student's homes, in theory, although this would be extremely difficult but very much in the realm of possibility.
The greatest fear to arise from this program was that of the many students who would travel, on foot, past wooded areas of town where there was very low visibility. Using an RFID reader, a potential abductor could, over a period of days, identify students that he was interested in abducting. Then, while hiding in the cover of the woods, could utilize RFID to determine when the student that he was after had been left alone by other students. The ease of abducting student during their travels to and from school was at an all time high. Imagine when parents realized that their students safety was at high risk and that the system had no security advantages over far cheaper and simpler solutions like barcoding or mag-striping. Someone in the district likely thought that RFID was "hot" and that a system like this would be a ticket to a promotion. As adults we need to be aware of the dangers of broadcasting the identity and location of our children. Any technology that uses radio frequency can be seen by anyone using extremely low cost equipment.
Another example, fortunately not involving children, that did end in disaster was that of a government agency in Mexico City. This certain Mexican government agency decided that in order to be absolutely sure that only autorized personnel were able to gain access to their office building that they would have active RFID tags inserted under the skin of their employees. At first, this sounded like a great idea, at least to those who did not have to have the surgery performed on themselves. However, it took very little time before the problems of a system such as this began coming to light.
Criminals seeking to gain entrance to the department found that they were able to frequent the local bars, restaurants and coffee shops and were able to identify department personnel from their RFID broadcasts. Using this system they would also have been able to learn their break patterns, clothing, hair styles and other information necessary to impersonate someone. Then, they were able to make their own matching RFID tags that they could simply slip into their pockets. Using their RFID readers they would then determine when a person had definitely left the government building and had entered a restaurant or bar and then would enter the building themselves. There were security guards in place who would look at the badges and, one would hope, would recognize the people that they saw every day. But, because of the false sense of security providing by an RFID system, the guards stopped checking people as carefully and criminals were able to easily come and go in the buildings with the sense of security of knowing that at least THEY were aware of the movements of the people that they were attempting to impersonate and could be sure that they had not tried to re-enter the building yet.
The bottom line in RFID is that the use of active tags is great for items like palettes of canned goods, dorm refridgerators, car parts, etc. They are great for tracking all kinds of objects. But when it comes to tracking people, active RFID is extremely dangerous. There is a reason why, in the past, only seriously dangerous criminals were ever tagged with a system such as this. Only criminals dangerous enough that the public deemed their safety of little concern. We should hardly treat our children in the same way. These were systems not designed to protect criminals from the public but to protect the public from the criminals. Tagging children or children's clothing is hardly going to protect any adults on a cold night in a dark alley from being jumped by four year olds looking for a wallet and car keys.
posted by Scott Alan Miller at
10:36 PM
0 Comments:
Post a Comment
<< Home