Interesting People mailing list archives
California Bill to Limit RFID
From: David Farber <dave () farber net>
Date: Fri, 29 Apr 2005 12:13:35 -0400
------ Forwarded Message From: William Law <law () tc cornell edu> Date: Fri, 29 Apr 2005 11:26:51 -0400 To: <dave () farber net> Subject: California Bill to Limit RFID For IP if you wish. State Bill to Limit RFID By Kim Zetter Story location: http://www.wired.com/news/privacy/0,1848,67382,00.html 02:00 AM Apr. 29, 2005 PT While civil libertarians battle the federal government's decision to embed RFID chips in new U.S. passports, a California bill is moving swiftly through the state legislature that would make it illegal for state agencies and other bodies to use the technology in state identification documents. The bill, which California lawmakers believe is the first of its kind in the nation, would prohibit the use of radio-frequency identification, or RFID, chips in state identity documents such as student badges, driver's licenses, medical cards and state employee cards. The bill allows for some exceptions. RFID, also known as contactless integrated circuits, transmits information wirelessly, allowing scanners to read cards from a distance, typically a few feet. The technology is widely used in building security and inventory-tracking systems, and is being considered for numerous other applications. The bill, which passed out of the state Senate Judiciary Committee on Tuesday with a vote of 6 to 1, also would outlaw skimming -- which occurs when an unauthorized person with an electronic reading device surreptitiously reads the electronic information on an RFID chip without the knowledge of the person carrying or wearing the chip. "It's heartening to think that hopefully the government is starting to recognize the seriousness of the security and privacy implications," said Nicole Ozer, technology and civil liberties policy director for the American Civil Liberties Union of Northern California, which helped draft the legislation with the Electronic Frontier Foundation and Privacy Rights Clearinghouse. State Sen. Joe Simitian, a democrat representing a district in Northern California, introduced the Identity Information Protection Act of 2005 (SB682) in February after a small-town California school received national attention for launching an RFID program to track students without properly notifying parents or students. In January, Brittan Elementary School in Sutter, California, began requiring students to wear photo ID cards embedded with an RFID chip containing a 15-digit number assigned to each student to track attendance. The school cut a deal with a local maker of the technology to test the tracking system and receive a percentage of profits if the company succeeded in selling the system to other school districts. But after a group of outraged parents protested the plan, the school dropped it. Simitian said the incident was the catalyst that was needed to address a technology that was on its way to becoming ubiquitous. "(The use of RFID) is an issue we've been following for some time in the legislature, but mostly in (relation to) the retail setting in years past," Sen. Simitian told Wired News. "But the events in the Northern California school district brought the personal privacy issues (regarding the technology) into sharp relief." Simitian said California's move was also spurred by plans at the federal level to use RFID in passports. "If you've got a discussion going on that reaches from neighborhood elementary schools to the U.S. Department of State, that suggests that it's time to confront the position and try to put some thoughtful, rational policy in place," he said. Concerns about RFID center around surreptitious scanning and tracking, since data on the chips can be picked up by either an authorized or an unauthorized reader without the knowledge of the person carrying the chip. For example, a student participating in a protest on a state university campus could be scanned by a campus policeman carrying a reader to track his political activities. Or, depending on the kind of data stored on the card, someone could read the data on a chip in order to clone it and create false documents. The bill allows for a number of exceptions for the use of RFID, such as devices used for paying bridge and road tolls, ID badges used for inmates housed in prisons or mental health facilities, or ID bracelets and badges used for children under the age of four who are in the care of a government-operated medical facility. The bill allows agencies to obtain additional exceptions to the ban if they can prove to the legislature that there is a compelling state interest to use it in certain situations and can prove that other, less invasive technologies would be unsuitable. The bill allows state agencies that already have RFID devices in place -- such as the Senate and Assembly office buildings -- to phase them out by 2011. "RFID in itself is not a bad thing. But there are circumstances where RFID technology is not appropriate because of the privacy and security risks," said Ozer. "There are other (technology) options that deliver the same kind of convenience without the same kind of privacy concerns. Right now there's no mechanism, no control over the state deciding to adopt RFID without having staff think about why they need the technology." The bill has the support of a wide range of consumer and privacy groups, in particular groups concerned with domestic violence and stalking, who fear that RFID would expose the whereabouts of women and children who have fled dangerous home environments. It also has bipartisan support from conservative and liberal lawmakers and organizations like the conservative Capitol Resource Institute. "It's restoring my faith in the political system that it doesn't have to be a bipartisan issue and that they can put party politics aside and just do what's good for the people of California," said Michele Tatro, mother of two Brittan Elementary School students, who helped lead the fight against her school district's RFID program. "This issue is wrong for the state of California and they recognized it right away." Tatro, along with her husband and two teenage children, appeared at a state Senate Judiciary Committee hearing to discuss the bill on Tuesday, where she said committee members expressed "shock and amazement" when the parent of another Brittan student described what happened at their school. "They couldn't believe what (we) told them," Tatro said. "By their facial reactions you could tell that the panel was appalled." Tatro said her kids were pleased that the bill was moving forward but said they hadn't yet grasped its full significance. "It's still sinking in to us, the fact that this is the first legislation of its kind, not only in the state of California but in the nation," Tatro said. "I don't think they realized the gravity of that, how big that is." The bill will likely reach the Senate floor in late May or early June. Ozer said she hoped the move in California would spur federal legislators to re-examine their use of RFID in passports. "California legislators are often on the forefront of these issues, and they definitely sent an important message by moving the bill on," Ozer said. "After all of this talk, hopefully some congressmen are finally waking up to the serious privacy and security ramifications of utilizing this technology in identification documents." The Association for Automatic Identification and Mobility, a group representing the RFID industry in the United States, was unavailable for comment late Thursday. ------ End of Forwarded Message ------------------------------------- You are subscribed as lists-ip () insecure org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/
Current thread:
- California Bill to Limit RFID David Farber (Apr 29)