Schneier on Security

Ross Stapleton-Gray • July 26, 2005 12:08 PM

The Register article was a little lurid… I know it’s a sexy lede to use “former CIA analyst,” but I’ve been on to many thing since.

My thoughts on RFID is that it’s something of a steamroller coming, though not all that different from a host of other, little marginal enhancements in technology for tracking, visualization, etc., that are going to collectively peck away at privacy like myriad ducks (see for example, this just-awarded NSF grant for improving persistent visual tracking: https://www.fastlane.nsf.gov/servlet/showaward?award=0535324). The purpose of the Sorting Door is in part to more openly demonstrate what’s likely happening behind the scenes, and to give some hooks for better research on technologies and policies to mitigate some of the problems.

My thoughts on government and information collection/analysis, as a former fed, is that I don’t want to be safe from government because government can’t “connect the dots”… that leads to government by the inept and wasteful. I’d like to be safe from government because there’s appropriate and rigorous oversight, so that, for example, it’s relatively easy for the FBI to collect and assess information on anyone they can get a warrant on, but each and every case they take up can be scrutinized by judges, and aggregate information (e.g., how many wiretaps they carry out) is available to the public, so we can decide just how comfortable we are with how our government works.

We’d welcome interest in participation in the Sorting Door work, and can share some additional papers on RFID, security, surveillance & privacy not available on the public area of the company site (http://www.stapleton-gray.com/papers/) for those with an interest there.

Ross Stapleton-Gray • July 26, 2005 3:27 PM

I’m wondering if it would be a simple thing to produce tags that would generate false positives to the data collectors…

Most tags are quite simple and dumb, about as “smart” as an electronic print bar code, so creating a fake one would be easy (this isn’t necessarily the case with more complex, active tags like what’s in your FasTrak transponder in your car).

Google on “blocker tag” and “rsa” for some discussion of the idea of masking tags or “spamming” tag readers.

There’re a number of discussion threads on RFID for applications like anti-counterfeiting, etc., on our blog (http://www.stapleton-gray.com/surpriv/)

Ross Stapleton-Gray • July 27, 2005 2:15 AM

That’s an interesting question, and one of the reasons behind the whole idea of the Sorting Door… given that RF is effectively invisible to humans, how do we know where tags and readers might? Doors (e.g., with an accompanying information kiosk, which is what’s intended to be depicted in the graphics on the Sorting Door web site) could allow one to “scrub” onesself for tags (or other RF-emitting or responding devices); something to detect readers would be the other side of the coin.

Various research projects are examining “augmented reality,” e.g., overlaying a scene with data, like closed captioning… one could imagine doing that, with an RF detector feeding data to a visual display, so that if one looked around in a retail store, you’d see the readers as bright blobs, and (some of the) tags as little blobs.

Ross Stapleton-Gray • July 27, 2005 2:40 AM

So eventually everyone will be caught on every minor infringement they have committed.

This recalls the Panopticon: http://en.wikipedia.org/wiki/Panopticon
It’s not that everyone will be caught on every infringement, but that everyone will be aware that they may be under surveillance at all times.

I’m actually something of a skeptic that we’ll really need to worry about RFID tags on goods in commerce; I suspect that item-level tagging for many of the proposed applications (such as detecting employee theft) will be something of a bust, either insufficiently effective, or easily subverted. RFID in commerce will work best in highly-controlled environments, i.e., nowhere near the retail store floor, with all those messy customers mucking about. (See our white paper, “Scanning the Horizon,” at http://www.stapleton-gray.com/papers/)

On the other hand, there are a lot of RFID-capable items and devices out there already, e.g., access badges, payment devices like Mobil Speedpass, etc., and we’ll keep adding to them. And people will choose to start tagging themselves, for various little happy applications like opening their front door automagically or whatnot.

And, on the other hand, there are a lot of non-RF surveillance technologies that will be steadily improving, e.g., machine vision (which seems like it would be much more useful to solve retail store theft problems).

We’re going to need to address an increasing number of privacy questions, with or without RFID.

Ross Stapleton-Gray • July 27, 2005 2:48 PM

In the scenario where you’ve got an Electronic Product Code (EPC) tag on your person, that number could be 1. An EPC is (that is to say, one of the standard formats for an EPC is) the code that’s in a regular UPC bar code today, plus a unique serial number. So that if you have a particular Eddie Bauer jacket tagged by the manufacturer, it would be uniquely identifiable from every other EB jacket, and if some party matched you with that jacket (e.g., when you presented a credit card, or got carded at a bar), one could be pretty sure that every other encounter of that particular jacket implied you. (It should also be readily knowable when the tag is seen that it’s attached to an Eddie Bauer jacket, as all the manufacturers should presumably want to base their EPCs off the UPCs they’re already widely using, and there are various providers that can map a UPC to a product, e.g., QRS and GXS, for supply chain interests.)

Obviously some fuzziness… if you sold or donated the jacket; library books, which are now often RFID-tagged, are by definition loaned to numerous individuals; etc.

But again, I wouldn’t focus as much on EPC tags on retail goods, as it would seem that they’d be more likely to be embedded in discardable packaging, or (for cheaper goods) too expensive to use. The more interesting area may be all of the other RF-responsive things that people carry today, or which will be invented soon. We’ll be small, mobile clouds of RF responsiveness, and some of those signals will be globally-unique IDs that might be used to mark our progress around town, or the world.

(You’ll certainly hear, “RFIDs can’t be used to track people,” which is more or less true of passive RFID. We’re using “point surveillance” to describe the idea that various readers deployed by various parties in obvious places, such as doorways, will collect little connect-the-dot maps of activity.)