Schneier on Security

Steve S. in Jamaica, NY • November 13, 2006 2:53 AM

This move toward emplacing all-too-easily-hackable RFID-chips into our credit cards (and into other such info-cards that we may carry, such as medical i.d. cards, healthcare-insurance cards, national-identification cards, even our passports) is just the beginning.

The next likely step — already having been implemented in at least one (if not more) Mexican government agency and several US businesses, as well as voluntarily by some posh overseas resorts/nightclubs for its “elite” members, to name a few such instances — is the implantation of RFID-readable identity-&-information chips into humans.

And the speculation is that, like it or not, the time may not be far off when such implantations may be required — by Governments or corporations — on a massive scale.

If the push is cleverly handled, many people — in the same way as the above-mentioned nightclub-elite — may be persuaded to eagerly desire such implantations because of the perceived perks that having those implanted chips may bring. But ahh, the concomitant dangers? Shhh! Not to be discussed!

But if the push toward universal implantation is Governmentally-mandated (much as various vaccinations in American children have been mandated, even over parental objections) — perhaps with the excuse being offered that this is a necessary way to guard against terrorism or the spread of the Bird Flu, etcetera — then what will come of us?

What will come of us if not only our Government — with whatever its conglomeration of motives — thus gains access to all our most personal data wherever we go and whatever we do? What if, also, other clandestine forces — whether other regimes or corporate entities or terrorists or crime-syndicates or anyone else with the appropriate technology — gain access to this same personal data?

In a world fraught with (so we are told) the rapidly spreading/increasing threats, on a broadening almost-global scale, of unstoppable terror-attacks, and of the unfettered — and the quasi-legal and also illegal expansion/application of espionage-technologies so as to clandestinely wrest from us every formerly-private detail of our personal lives — the bigger question is: where is all this headed?

And who, and with what wisdom — or lack thereof — and with what motives, and with what level of power, will be in charge?

For example: Look at the Credit Card Law that the Bush Administration pushed through Congress about a year or so ago: it gave the card companies and the banks huge additional powers, and tore away from all other Americans various vital previously-existing financial rights, such that while corporations could still easily declare bankruptcy and thus basically get off scot-free from having to follow-through on any previous financial responsibilities to their average American creditor, the law also now put the average American card-holder on the hook, making a declaration of individual bankruptcy next to impossible, even in the harshest and most cruel of circumstances. Become seriously ill, get screwed by your medical insurance plan (if you’re fortunate enough to have one, and there are millions of Americans who cannot afford even that!), and you could lose everything through no fault of your own — and still the card-companies will now have the right to come down on you like a ton of bricks and take anything you have left, even if doing so takes away any straggling coins that you may need for a bottle of life-giving medicine. At least that’s my understanding of the situation.

Or, for a more simple case, just consider the many cases — some of which you can easily Google-search, and many of which are never publicized by the affected companies — in which purportedly encrypted, hacker-safe, intensely-guarded, private data from customer- and business- databases have been stolen or “inadvertently” been transmitted to the wrong parties. Hundreds of thousands of records, of social security numbers, other such extremely personal information — hacked, lost, stolen, publicized. And that’s been WITH “safeguards”.

Now take any of these scenarios as a real-life parallel to what could just as well happen to our data in our new and rapidly-progressing RFID-technology world.

Against even the possibility of that sort of backdrop coming into view, who among us can feel at ease with how this RFID-technology — promising and important as it certainly may be in many instances (such as in tracking transport-vehicles and cargo-containers to enhance business operations or guard against criminal/terrorist activity) — is being implemented to our potential detriment?

Where are the safeguards? Where is the Congressional (and international) oversight?

Where is our (e.g., the People’s) voice?

Perhaps now is an excellent time to write and fax and phone our Members of Congress, in both Houses, and urge them to design & submit & pass legislation that would require (a) the implementation of truly adequate (not cosmetic) limitations on the applications of RFID technologies and (b) the implementation of truly adequate (not cosmetic) protections for whatever data RFID-chips/technologies are supposed to handle, before those technologies/chips will be permitted to be used in any context that might involve any of our personal data.

I propose too that other international agencies be pressed to develop such safeguards as well. Perhaps the United Nations, for instance, would be a good start. And the European Union. This is, after all, a global phenomenon — and it’s just getting started. Now is the time to do something about it.

While there is still time.

— SS.