RFID plus NIR equals big brother

I got this email as someone potentially interested in the privacy issues raised. I'm still deciding how I feel and think about it: some of it comes over as borderline paranoid; but just because you're paranoid, doesn't mean they're not out to get you! So I'd love some thoughts from you readers; either comment-wise or more one-to-one (I know some of you don't want to sign up to comment, and I don't want to be dealing with loads of spam comments by opening up comments to all-comers).

A new system to track your movements, as they happen
Imagine a world where you are allowed no secrets.
Imagine a world where everywhere you go is logged, recorded and posted on the internet, immediately, as soon as you arrive.
Imagine that every time you enter or leave a building, you are scanned and that a full report of everything you are wearing and carrying is posted instantly on the internet - intended to be accessible, so lots of people can read it - yes, even your underwear, what you have in your pockets, your bag or briefcase. All this information will be available to corporations (or potentially anybody).
They will know what clothes you have on (and maybe who paid for them!), when you last changed them, how much soap powder you buy. They will know if you have a condom in your wallet, or a tampon in your bag, whether you are carrying an adult magazine or haemorrhoid cream. And they will have a complete record of everything you ever bought.
This isn’t science fiction, but a new European Union policy
The EU want to authorise an electronic system that would do exactly this, and may legislate within months to make it happen.
All this can be verified from the European Commission’s own website.
This can still be stopped, but you have to do something - now, today.

This is an appeal for help, to lobby MEPs, in the lead-up to the election to the European Parliament, on 4 June 2009. (This letter gives MEPs emails and all the information you need - scroll to the end).
If you forward this message to 5 friends, like a chain letter, you can help ensure this EU measure gets exposed and defeated - even if you don’t write to your MEP yourself.

So, what is this tracking system?

Welcome to RFID
RFID is a system for tracking people and their possessions 'in real time'.
Tiny radio transponder chips will be placed in everything you buy, each carrying a unique ID number. That number can be scanned from a distance of up to a few feet.
RFID is intended to replace bar-code scanners, anti-theft barriers at stores - and do a whole lot more.
The ‘Internet of Things’ (also called ‘Internet 3.0')
This is the system that will allow RFID data to be posted on the internet, immediately.
In the ‘Internet of Things’ every object will have its own internet web-page, with its RFID number being its web-address. Every time an object is scanned by an RFID reader, the time and place will be logged on its web-page, together with other information, such as purchaser, etc..
Tracking
The record of the object’s movements will also be a record of its owner’s movements, and it will be a simple matter to cross-reference to identify all a person’s belongings.
Items such as shoes and underwear generally are used by only one person and rarely swapped or shared.
Tracking these objects’ history, on the Internet of Things, they will have tracked all your movements, your entire life. In fact, IBM already have a patent on this (US #200220165758 - ‘IDENTIFICATION AND TRACKING OF PERSONS USING RFID-TAGGED ITEMS’).
Turning numbers into names - ID cards and the National Identity Register
Ultimately, the system needs a cross-reference to turn those numbers into a name and address.
Stores could capture your name if you use a bank card to pay at some time. (And some banks have experimented putting RFID in payment cards).
The ultimate answer, however, will be ID cards and the new government identity database that will go with them. Britain's (and soon, all of Europe's) ID cards will have an RFID chip implanted in them - just like new passports - that's EU policy.
Your identity will be for sale to corporations. That's going to make it child's play to identify anyone as soon as they walk in. It's so useful, you would almost think that's what ID cards were always intended to do - to identify you to corporations.
Profiling - Analysing your behaviour and personality
So, once they have gathered all of this data, what are they going to do with it?
Marketing has spawned a whole huge industry of gathering personal data, and analysis systems, to identify big-spenders (and discourage bargain shoppers) to increase stores' earnings per shopper.
Corporations have sophisticated software that can analyse your purchases and habits, to ’profile’ your personality and psychology, for marketing purposes - to assess your weaknesses and suggestibility. It works and it’s very effective.
There will be software to analyse your movements and any patterns in them. They are going to know if you go shopping with your family, or with someone else. They will be able to guess if you are seeing someone other than your wife or husband. They will be able to guess the names of all your friends, and know where they live, what they do and any affiliations they have.
All this is also going to be available to the government, your local council, your employer - and to potential blackmailers.
Employers
Imagine a world where corporations profile their staff, and every year ‘rotate’ (i.e. fire) a percentage of their employees, to get a workforce with the ‘right’ profile, the right attitudes (Some companies already do this). Imagine how RFID tracking and profiling could facilitate a corporate culture like that.
Some public employers, in USA, have already started dictating diet and lifestyle strictures to their employees, with dismissal if you don’t comply. Your employer would know what you eat, whether you drink, whether and how often you go to the gym.
Nothing will be beyond examination
Corporations even want to put RFID scanners in your home - in your fridge and other appliances - that could see who goes to the fridge, how often, and what they take out.
RFID spychips have been placed in many new domestic ’wheelie bins’. This is to facilitate proposed charging by weight, for refuse collection. That means your waste bin (and hence your refuse) will be RFID scanned at collection.
The EU want to track RFID in refuse, to help recycling (See the official EC website page How can the Tags improve your life?). Who knows, that could mean, if you have put things in the waste bin that should have been recycled, you could be fined, automatically.
And corporations already pay for information about the waste in people’s bins, so they can see how quickly you consume their products.
Nothing will be beyond examination.

The aim of the RFID project is ‘Total Mobility’ - tracking all movement.
This is equivalent to total surveillance or total control.

Still can't believe it?
Want to read more? Here are a couple of independent articles on the subject: -
The Register
Scientific American

This is not science fiction. Some stores are already starting to fit equipment ready for RFID scanners. The only ‘science fiction’ about this is in the proposed ‘protections’ they are going to give us.

Who wants RFID?
There is an industry association, promoting RFID.
Global corporations that have wanted to introduce RFID include IBM, NCR, Intel, Procter and Gamble, Unilever, Gillette, Coca-Cola, Pepsi, Wal-Mart, Tesco, Phillip Morris, Kodak, etc..
However, industry's own research showed that 78% of the public are opposed to RFID.

What is the EU proposing to do?
The EU see this not as a nightmare but as a tremendous business opportunity.

The EU is proposing legislation and regulations, under 'harmonisation' rules.
Harmonisation means, if the EU permits RFID, then it is binding on everyone - individual member nations cannot opt-out or prohibit it. European legislation may be only months away.

Is this EU policy? Read for yourselves on the official European Commission website and a pdf here.
The EU are already financing this with millions, in support, and funding research at European universities.

This can still be stopped, but you have to do something - now, today.

EU proposed privacy protections
If you write to your MEP, they will tell you about their proposed (supposed) privacy protections. These sound great at first: -

* ‘Opt-in‘ privacy, meaning RFID tags would be automatically disabled at the check-out, unless you opt to keep them live.
* Prohibition of junk mail and marketing, unless you opt-in.
* Existing EU regulations, on the storage and processing of personal data.

These protections sound good, but are they as good as they look?

1. The privacy proposals aren’t firm yet - they are still 'evolving' and may not be confirmed.
2. One powerful reason things might change would be the proposed international treaty on data privacy, which will include USA. The US treats personal data as an important commercial commodity. Even our current protections could be up for re-negotiation.
3. The EU wants to make you carry RFID you can't disable, by putting it in all government issued documents, passports, 'entitlement cards' and ID cards. Even if RFID tags in purchased items are disabled, there will still be plenty more tags to track us.
4. You are probably already carrying RFID - in things you would never think of - library cards, photocopier cards, ‘Oyster’ cards for the London Underground, etc.. There are items industry sneaked in while you weren't looking. Let’s not build the infrastructure to track these.
5. Disabled tags may not be ‘dead’ but merely ‘sleeping’. Somebody may be able to reactivate your tags without your knowledge. RFID tags can be programmable and capable of being turned on or off, given a new number or extra new information - even viruses. RFID technology can be hijacked for unauthorised uses and by criminals.
6. The EU want to track RFID in refuse, to help recycling (See the official EC website page How can the Tags improve your life?). How will they do that, if RFID tags are disabled? The tags can’t be both turned-off and yet still working at the same time. Something’s got to give, and it’s probably going to be your privacy.
7. Turn off the RFID chips and you could lose all right of refund or product guarantee.
8. RFID tags are only the first step in a much larger plan. The EU is pouring millions into research on RFID and ‘sensor networks’ (EU - The Future of the Internet, p98). They plan for RFID in everyone's homes. Does this sound like they want to let you turn it all off?
9. The tremendous money-making business opportunity that the EU hopes RFID will bring can't happen if the tags are turned off, or if all that data just sits inert in storage - it has to be analysed and exploited, and it appears intended it will be.
10. Systems like this are fundamentally compromising. Privacy regulations are worthless in the face of hackers and organised, international cyber-crime. If we are serious about privacy, we would never allow such data to be gathered, let alone put on the internet.
11. None of these regulations will stop foreign governments looking at the data. The US bought up information about voters, from private sources, in 11 different Latin American countries. It was alleged this could be used to influence electoral rolls, hence elections (by determining unfriendly voters and having them struck off the register) as has been alleged to happen in US domestic elections. And that's before we mention Russian and Chinese hackers. Or blackmail for espionage.
12. So, you won't get junk mail. Junk mail is just one impact of your personal data being visible to marketing analysis. It's more significant if your employer may be able to track your lifestyle, through the same data, out of sight.


The EU has a bad track-record on privacy and rights -
The EU has introduced a series of privacy-invading surveillance and ‘security’ measures

* A new five year plan for justice and home affairs that emphasises the surveillance state and keeping digital records of all citizens' activities
* Plans for database registration of all citizens and universal biometric ID cards, with RFID
* The EU directive (2006/24/EC) on 'data retention', creating a database recording all communications, phone calls and emails (incidentally, approved by the European Parliament)
* Introducing databases tracking political activists even before 9/11.
* The willingness of the EU to compromise to the US on privacy, shown in the release of airline passenger data to USA, with inadequate privacy protection.
* Plans to fingerprint all children, compulsorily over the age of 12
* An EU initiative to continuously track the speed and position of vehicles, about to go on trial in the UK
* An EU-funded pilot scheme in Romania to put RFID into all government documents

The EU wants to know everything about you
- but you aren't allowed to know anything about them!
The EU has a poor record of transparency.
EU decisions are taken in secret.
Votes at the Council of Ministers are secret - you aren’t allowed to know if your nation has voted for or against a new law.
EU finance is secretive. It has been plagued by fraud and corruption. It has failed audit for several years.

So, what can you do?

1) Tell your friends
This is the most important thing you can do.
If you have friends in (or from) other EU nations, it is especially important that you forward this message to them, so they can lobby MEPs in their own country.

But please, please try not to pass your friends' email addresses to strangers -
put people’s addresses ‘bcc’ and, before forwarding, delete any addresses that shouldn’t be seen.

2) Write to your MEP
Follow the steps on this website - it will tell you how to contact them
UK Office of the European Parliament
http://www.europarl.org.uk/section/your-meps/your-meps
Unlike the British Parliament, each Euro-constituency in Britain has three MEPs, not just one. We each have three different MEPs representing us, perhaps from three different parties.

Here’s a hint : - We have seen lots of replies from MEPs - most just waffle, and avoid any commitment to doing anything. When you write to your MEPs, it is important to use language that does not allow evasion.

Here is a suggested text: -

Dear MEP,

I am appalled by the European Union’s proposals for RFID and the Internet 3.0. This is unacceptable privacy-invading technology.
I am very concerned that neither you nor any other MEP has spoken out about this.
Unless you promise to vote against this, I won’t vote for you. And I'll tell my friends.
In fact, to believe in your sincerity, I want to hear pro-active proposals to block and prohibit RFID product tagging. I don't want RFID to be put in government documents.
I also want to hear you will stop EU funding for research on RFID and the Internet of Things.
Yes, I have heard about the EU proposals for privacy protection and, No, I am not impressed. Even 'Opt-in' is not enough to preserve our privacy. We should not be building an infrastructure for tracking people.
Yours,


3) Consumer protest
Supermarkets and corporations are hoping to introduce RFID with or without government help. Yes, we need to defeat the EU proposal, but we also need to stop the supermarkets.

Supermarkets and corporations may be powerful multi-billion dollar enterprises, but they are really scared of consumer pressure - and that’s where you come in.

Consumer protest has already stopped RFID in USA, the home of corporate power. That's why industry has now turned to Europe instead.

So, what is ‘consumer protest’?
It can be as little as telling your friends about a boycott of a store or a product that has introduced RFID.

4) Join CASPIAN (it’s Free!)
CASPIAN - Consumers Against Supermarket Privacy Invasion And Numbering - is the main campaign against RFID

The CASPIAN newsletter (by email, monthly, free) will tell you what‘s going on and give you suggestions about what you can do.

You can sign-up for the newsletter on the same site as CASPIAN membership: -

CASPIAN is a consumer group rather than a political organisation, even though this issue has a political dimension. CASPIAN is not aligned to any political party.
If you want more information, have a look at their website www.nocards.org


Sent by: Nathan Allonby
nathan.allonby(at)tiscali.co.uk

Firms bought secret personal data

A further reason to be wary about the proposed NIR which would be the teeth behind ID cards in this country. Firms bought secret personal data on staff - privacy chief | UK news | The Guardian: "Thomas believes that workers have been unfairly denied employment because they have had no chance of challenging any inaccurate information, some of which has been stored for decades." What happens when that kind of information is collected about everybody and is corrupted or unlawfully accessed? State-sponsored discrimination is what.

It's going to be a long, hard road to defend our liberties

I've not blogged much ID/NIR stuff latel. This not because there haven't been things written, more a sense that the developments are not particularly significant: the juggernaut trundles on through the countryside without reaching any particular junctions. The arguments against are still the same. However, I'm breaking my silence because I think that those who are concerned for the liberties of our older selves, our children and their children should take this moment to pause and make ready for the battle (for it is clear that the juggernaut is still going and hasn't been deterred by a series of cogent arguments or the demonstrable weaknesses of its own). In this pause for reflection, we can do worse than to note this article: Simon Carr: It's going to be a long, hard road to defend our liberties - Simon Carr, Commentators - The Independent. And here's an arresting quote to ponder as to why the argument has not been convincingly won: "most social democrats... enjoy an active state. They feel it's essentially benign, constructive and protective."
I think Simon is right: for in supporting No2ID I find myself sharing political space with some 'dodgy' characters: libertarians and Daily Mail readers who are relflexively anti state in a way that I am not always. And although I have a penchant for self-organising systems, I tend to feel that there are things that are well-done by larger democratically-accountable agencies; health care, for example.

However, more importantly is the appearance of a new argument (I think it is, at least. It's the first time I have sighted it in the wild):
"what does this surveillance and remote monitoring do to our political class? I bet it has a negative effect on their energy and humanity. According to the state, Arthur Koestler said, the definition of an individual is a million people divided by a million. If we, the subjects, become a screen experience, numbers to be crunched, that surely diminishes our masters' capacity to think of us in personal terms.
These vast schemes increase their credulity, arrogance and appetite for autocratic, unworkable solutions. The databases they sign up for at the cost of billions are not only vanity projects, they dehumanise the people who work in them. They reinforce the separateness of the political class from the rest of us."
Though again it may mainly appeal to the thought-out voter rather than the 'no more duty on beer and fags' voter. Yet for all that it will bear the analogy with warfare where the callousness of war increases with the disengagement of those pulling the trigger or pressing the button from the effects on their victims. That's still remote until you realise that we -that means 'I' multiplied by a million or several- are the ones having the missiles rain down on us. We will be the surveillance casualties akin to innocent Palestinians in Gaza. Maybe that's an argument that could get attention? If you think so; blog it, talk about it -influence opinion with it.

Htt No2ID
see also the Guardian's guide to how we got here.

What Vaclav Havel can tell us about liberty

I have a feeling in my bones that 2009 may become the make or break year for ID cards and the NIR. This opinion piece brings the issues out quite nicely. Henry Porter: What Vaclav Havel can tell us about liberty |Comment is free |guardian.co.uk. Here's the nub, I think: "the democratic state must be given power to act on behalf of us all but that is not the same as the state granting itself powers to know everything about us and to bully those who resist its invasive instincts. In 2004, the Courts and Tribunals Enforcement Act made it legal for the first time in 400 years for bailiffs to force entry into homes on a civil order and remove goods. Now we hear from the Justice Ministry that bailiffs may offer reasonable violence to force inside their own homes. That gives us an idea of how the government plans to enforce the �1,000 fines handed out to ID card refuseniks – ultimately by violence meted out by men who may be no better than nightclub bouncers. It is astonishing that we are going to allow this to happen."

Frog in the kettle ...

boiled by stealth. And that's the analogy the Indy's editorial gives us for NIR and ID cards under the present government: "The Government's strategy on ID cards has been to turn up the heat slowly on us all. Foreign nationals will be the first to receive them; then Britons who work in tight security zones such as airports. People who renew their passports will be next to be given then. Eventually, a general roll-out."
With the editor I cheer the airline pilots' union's intention to strike against the introduction of them to airport-related workers. May their efforts be fruitful and may they not lose their nerve. Do I get an 'Amen'?
Leading article: Jumping frogs - Leading Articles, Opinion - The Independent:

The government is introducing ID cards by stealth

Indeed they are and I felt a chill grip my heart as I read about it today. In response Nick Clegg produced one of the better political soundbites of the month, calling ID Cards "a laminated poll-tax". Sadly not in this article, but lots of good points are. Look at the comments and note that some correspondents have missed the point: it's not so much the ID cards as physical entities (though that's bad enough) but the NIR database behind them that's the big threat. Anyone fancy letting the government lose (for example), leak or sell 60 million of our identity markers at once? Nick Clegg: The government is introducing ID cards by stealth | Comment is free | guardian.co.uk

Public does not trust government with personal data

A report in Computer Weekly entitled Public does not trust government with personal data | 18 Mar 2008 | ComputerWeekly.com: tells us some interesting stats.

"Only one in 10 adults in the UK trusts the government with their personal data, an online survey reveals. ... The survey found 41% were in favour of introducing ID cards in the UK, 40% were against, and 19% undecided."

Presumably the 31% who were in favour of introducing ID cards but didn't trust the government were in favour of introducing them to other people!

Data is leaky: NIR be warned

Just as UKgov is reeling from various scandalous data insecurities coming to light, here comes some research to show that data security is probably a lost cause. The synopsis is here: How Safe Are Your Personal Records In The Hands Of Government Officials? and we are told; "no matter what steps an organisation takes, they will always run the risk of being compromised by human psychology and the way we perceive risk on a day-to-day basis," I think that this indicates that we should be into risk mitigation not a super-duper centralised database that falls open once cracked. Decentralisation is usually the way to do that kind of mitigation.

More tech concerns for ID cards?

Now, I'm aware that this might not transfer, since we don't know the specifications of the system the UK government is setting up (and UK gov doesn't either!), but since one of the arguments has been to do with compatibility with (USA) passport systems, then there is concern latent in this report, I suspect for the UK gov's system.

If a reader could be compromised using Grunwald's technique, it might be reprogrammed to misreport an expired passport as a valid one, or even -- theoretically -- to attempt a compromise of the Windows-based border-screening computer to which it is connected.

Also check out previous posts on ID cards

Children's NIR can't be guaranteed as safe

I can't help feeling that this 'trial run' of ID cards /NIR rather blows the gaffe on the whole enterprise, particularly the claim to protect our identities from misuse.

Though it stresses the sophistication of the electronic security surrounding the databank, it acknowledges: "No system can be 100% guaranteed against misuse." The government was warned by family campaigners that parents would be concerned about the number of people able to search the database, and about the potential security risk.

I think that this is a recognition, in effect, that the concerns about NIR wrt security are well-founded and that in reality there is no security. Time to stop wasting our money on developing this white elephant.
330,000 users to have access to database on England's children | Special Reports | Guardian Unlimited Politics

Technorati Tags: ID_cards, NIR, UK, security, costs

Police chief agin NIR

A UK police chief has expressed skepticism about ID cards.

"In creating a national database you are creating a gold standard for ID [authentication]. It will be worth whatever it costs to hack it, to mirror it and subvert it. ... We are at risk from insider threats and card cloning. The idea the card can be used to fight terrorism is completely fatuous. This scheme is convenient for government, but not for citizens. .. " The police chief said that, if hackers can break into Nasa, then there is no such thing as total security, and that the cost of the scheme (£5.7bn) is "a huge cost to subject people to".

Police chief criticises ID cards scheme - ZDNet UK

Technorati Tags: ID_cards, police, UK, security, NIR

Still think we should have a National Identity Register?

It's worrying enough to read of the pig's-ear that's been made of this.

Hundreds of register offices across the country have been ordered to abandon a new online system for recording births, deaths and marriages in the latest IT fiasco to hit the government.

But then go to the end of the article for the reminder of how many government IT projects have bitten the dust. And then there's the clear precedent of function creep identified in this report: "State databases, the way the European Data Protection Supervisor talks about them in its annual report quickly grow beyond their function and not always with benign consequences for the people they have numbered." So, thank God for the failures -even if not for the waste of public moneys.
Chaos as register offices are told to abandon £6m computer system-News-Politics-TimesOnline

Technorati Tags: ID_cards, NIR, UK, IT