California Bill to Limit RFID

[David Farber <dave () farber net>]

------ Forwarded Message
From: William Law <law () tc cornell edu>
Date: Fri, 29 Apr 2005 11:26:51 -0400
To: <dave () farber net>
Subject: California Bill to Limit RFID

For IP if you wish.

State Bill to Limit RFID  By Kim Zetter
Story location: http://www.wired.com/news/privacy/0,1848,67382,00.html

02:00 AM Apr. 29, 2005 PT

While civil libertarians battle the federal government's decision to
embed RFID chips in new U.S. passports, a California bill is moving
swiftly through the state legislature that would make it illegal for
state agencies and other bodies to use the technology in state
identification documents.

The bill, which California lawmakers believe is the first of its kind in
the nation, would prohibit the use of radio-frequency identification, or
RFID, chips in state identity documents such as student badges, driver's
licenses, medical cards and state employee cards. The bill allows for
some exceptions. 

RFID, also known as contactless integrated circuits, transmits
information wirelessly, allowing scanners to read cards from a distance,
typically a few feet. The technology is widely used in building security
and inventory-tracking systems, and is being considered for numerous
other applications.

The bill, which passed out of the state Senate Judiciary Committee on
Tuesday with a vote of 6 to 1, also would outlaw skimming -- which
occurs when an unauthorized person with an electronic reading device
surreptitiously reads the electronic information on an RFID chip without
the knowledge of the person carrying or wearing the chip.

"It's heartening to think that hopefully the government is starting to
recognize the seriousness of the security and privacy implications,"
said Nicole Ozer, technology and civil liberties policy director for the
American Civil Liberties Union of Northern California, which helped
draft the legislation with the Electronic Frontier Foundation and
Privacy Rights Clearinghouse.

State Sen. Joe Simitian, a democrat representing a district in Northern
California, introduced the Identity Information Protection Act of 2005
(SB682) in February after a small-town California school received
national attention for launching an RFID program to track students
without properly notifying parents or students.

In January, Brittan Elementary School in Sutter, California, began
requiring students to wear photo ID cards embedded with an RFID chip
containing a 15-digit number assigned to each student to track
attendance. 

The school cut a deal with a local maker of the technology to test the
tracking system and receive a percentage of profits if the company
succeeded in selling the system to other school districts. But after a
group of outraged parents protested the plan, the school dropped it.

Simitian said the incident was the catalyst that was needed to address a
technology that was on its way to becoming ubiquitous.

"(The use of RFID) is an issue we've been following for some time in the
legislature, but mostly in (relation to) the retail setting in years
past," Sen. Simitian told Wired News. "But the events in the Northern
California school district brought the personal privacy issues
(regarding the technology) into sharp relief."

Simitian said California's move was also spurred by plans at the federal
level to use RFID in passports.

"If you've got a discussion going on that reaches from neighborhood
elementary schools to the U.S. Department of State, that suggests that
it's time to confront the position and try to put some thoughtful,
rational policy in place," he said.

Concerns about RFID center around surreptitious scanning and tracking,
since data on the chips can be picked up by either an authorized or an
unauthorized reader without the knowledge of the person carrying the
chip. 

For example, a student participating in a protest on a state university
campus could be scanned by a campus policeman carrying a reader to track
his political activities. Or, depending on the kind of data stored on
the card, someone could read the data on a chip in order to clone it and
create false documents.

The bill allows for a number of exceptions for the use of RFID, such as
devices used for paying bridge and road tolls, ID badges used for
inmates housed in prisons or mental health facilities, or ID bracelets
and badges used for children under the age of four who are in the care
of a government-operated medical facility.

The bill allows agencies to obtain additional exceptions to the ban if
they can prove to the legislature that there is a compelling state
interest to use it in certain situations and can prove that other, less
invasive technologies would be unsuitable. The bill allows state
agencies that already have RFID devices in place -- such as the Senate
and Assembly office buildings -- to phase them out by 2011.

"RFID in itself is not a bad thing. But there are circumstances where
RFID technology is not appropriate because of the privacy and security
risks," said Ozer. "There are other (technology) options that deliver
the same kind of convenience without the same kind of privacy concerns.
Right now there's no mechanism, no control over the state deciding to
adopt RFID without having staff think about why they need the
technology." 

The bill has the support of a wide range of consumer and privacy groups,
in particular groups concerned with domestic violence and stalking, who
fear that RFID would expose the whereabouts of women and children who
have fled dangerous home environments. It also has bipartisan support
from conservative and liberal lawmakers and organizations like the
conservative Capitol Resource Institute.

"It's restoring my faith in the political system that it doesn't have to
be a bipartisan issue and that they can put party politics aside and
just do what's good for the people of California," said Michele Tatro,
mother of two Brittan Elementary School students, who helped lead the
fight against her school district's RFID program. "This issue is wrong
for the state of California and they recognized it right away."

Tatro, along with her husband and two teenage children, appeared at a
state Senate Judiciary Committee hearing to discuss the bill on Tuesday,
where she said committee members expressed "shock and amazement" when
the parent of another Brittan student described what happened at their
school. 

"They couldn't believe what (we) told them," Tatro said. "By their
facial reactions you could tell that the panel was appalled."

Tatro said her kids were pleased that the bill was moving forward but
said they hadn't yet grasped its full significance.

"It's still sinking in to us, the fact that this is the first
legislation of its kind, not only in the state of California but in the
nation," Tatro said. "I don't think they realized the gravity of that,
how big that is." 

The bill will likely reach the Senate floor in late May or early June.

Ozer said she hoped the move in California would spur federal
legislators to re-examine their use of RFID in passports.

"California legislators are often on the forefront of these issues, and
they definitely sent an important message by moving the bill on," Ozer
said. "After all of this talk, hopefully some congressmen are finally
waking up to the serious privacy and security ramifications of utilizing
this technology in identification documents."

The Association for Automatic Identification and Mobility, a group
representing the RFID industry in the United States, was unavailable for
comment late Thursday.


------ End of Forwarded Message


-------------------------------------
You are subscribed as lists-ip () insecure org
To manage your subscription, go to
  http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/