September 13th, 2007
Why the ban on mandatory RFID implants should be Federal
The California legislature recently banned employers from mandating RFID (Radio Frequency Identification) implants for their employees. While I’m glad I’m covered in my state, why isn’t this ban being implemented at the Federal level to cover every citizen? I’m not suggesting that we ban the devices; I’m suggesting that no one should be forced to stick on of these in their body just to get a job. I’ve covered the issue of RFID many times before and I’m not fundamentally opposed to RFID technology or RFID implants, but I do oppose the idea that anyone should be forced to implant one in their body and it would be just as offensive if my employer asked me to tattoo a bar code on to my forehead.
It would be just as offensive if my employer asked me to tattoo a bar code on to my forehead
Verichip RFID implants are worthless from a security standpoint because they’re essentially passing clear text data over the radio waves and it can easily be cloned. If it’s cloned, you’ll have to undergo knife treatment to get a new one unless the chip is reprogrammable. Even if Verichip stopped using clear text authentication and switched to strong NSA Suite B grade crypto, I wouldn’t want it inside my body. Is any material item in this world worth life or limb? If someone wants my access device and password at the point of a gun, I’d give it to them. I don’t want them to have to cut it out of my body.
Last summer there were some issues raised about the privacy and safety of RFID enabled passports. While the scenarios were arguably remote and the privacy concerns overblown because someone can copy the same information from a regular passport, there is no reason to have the RFID in the passport since an optical or contact based system would have the same effectiveness. RFID in the traditional sense gives you more flexibility and convenience because of its long wireless range but the usable range for RFID passports is literally a few millimeters away. RFID in the Passport implementation is effectively a contact based solution that has none of the flexibility but all of the security liabilities of a wireless solution.
What about the argument that we need RFID implants for our children? I have two kids and I can tell you that RFID isn’t going to make me feel any better. First of all, that RFID implant isn’t going to be a “LoJack” device for children and you’re not going to be able to track them down if they’re abducted unless you’re within a few feet of the child. Second, having the RFID implant might mean the abductor will cut it out of your child to take out the implant. I might consider an external device hidden in a watch or something that has an active transmitter with some effective range but implants are simply out of the question.
As critical of RFID as I am, I’m not so sure why some people are so anti-RFID that they don’t even want the devices to exist in the first place. RFID implants can make sense in medical areas. If it makes it easier for emergency workers to identify a patient’s special needs, that’s great so long as the consumer gets to voluntarily place it in their own body. There’s also new technology being developed for diabetics where the RFID sensor can wirelessly report glucose levels without you having to prick your finger every day. RFID inventory tracking and logistics can simplify and automate many things so we must distinguish between good RFID devices and bad ones.
George Ou is Technical Director of ZDNet. See his full profile and disclosure of his industry affiliations.
