Security Watch | Matt Hines » Calif. RFID security bills advance

April 25, 2007 | Comments: (0)

Calif. RFID security bills advance

TAGS: Security

California State Senator Joe Simitian -- a Democrat representing the tech-heavy Palo Alto constituency -- is making headway in his push to establish security and privacy parameters for use of RFID technology in the state.

On April 24, Simitian's latest legislation - Calif. Senate Bills 28 and 29 -- received a go ahead vote from members of the state's senate and have passed on for review in the state's assembly.

Simitian's measures specifically require a moratorium in the use of RFID chips in Calif. driver's licenses and student IDs or records, based on privacy and security concerns related to wireless-enabled chips.

Bill 28 prohibits the Calif. DMV from issuing driver's licenses that use RFID to transmit personal information remotely. Bill 29 bans public schools from using RFID devices to track, monitor or record a student's presence on school grounds.

Simitian was quick to point out that he is not opposed to the use of RFID, but instead concerned about proposed adoption of the technology before all of its implications are understood, and before the systems have been proven hacker-safe.

"RFID technology is not in and of itself the issue. RFID is a minor miracle, with all sorts of good uses," Simitian said in a statement. "The issue is whether and under what circumstances the government should be allowed to compel its residents -- adults or children -- to carry technology that broadcasts their most personal information."

Simitian started researching the use of RFID in government-issued IDs after an elementary school in Sutter, California implemented a system that required students to wear badges that contained the chips.

Based on concerns that the technology could be used to track children's movements or scoop their personal information wirelessly, parents in Sutter successfully petitioned the school nix the program.

"Parents should be allowed to decide whether and how their children's information is gathered and shared," Simitian said. "The last thing we want to do is issue 20 million drivers licenses or 6 million student IDs without any privacy protections or limits on the information provided; privacy is an indisputable right under the California State Constitution. As such, we in government have a responsibility to protect it."

SB 28 passed out of the Calif. Senate on a 31-6 vote while SB 29 passed out of the Senate on a 28-5 vote.

The state senator is also currently pushing three other measures that address privacy concerns about the use of RFID.

RFID security has come under increasing scrutiny in the last year as the technology -- primarily used today by companies to track packages for purpose of logistics management and theft prevention -- has found its way into more controversial applications.

In a recent exercises, independent security researcher Adam Laurie has hacked both the RFID chips embedded in new U.K. passports and a chip that someone voluntarily had embedded under their skin (at the ShmooCon show in DC).

In another high-profile example of lax RFID security, researchers from IOActive have demonstrated a device which can be used to sniff unencrypted transmissions from RFID security card IDs and potentially spoof the devices.

The diversity of special interest groups that support Simitian's work illustrates the wide ranging concerns and cultural impact currently tied to use of RFID chips.

Among his supporters are some unlikely bedfellows including the ACLU, Gun Owners of California, Privacy Rights Clearinghouse, Citizens Against Government Waste, California State PTA, Republican Liberty Caucus, and the National Organization for Women (NOW).

Posted by Matt Hines on April 25, 2007 12:52 PM

RATE THIS ARTICLE: