When the Czech Republic introduced a new generation of passport incorporating RFID (radio-frequency identification) technology back in September 2006, privacy advocacy groups opposed to the “biometric” personal identification systems screamed bloody murder.
They were no less pleased with the introduction of Opencard, the so-called “intelligent” smart-card by which Prague residents and visitors can now pay to use the public transport system, gain admission to museums and libraries, and even use select parking lots.
Among those protesting the introduction of RFID chip-based systems was Iuridicum Remedium (IuRe), a Prague-based NGO dedicated to personal data protection that is part of the European Digital Rights network. Their main concern — and they have invoked the weight of the Office for the Protection of Personal Data (ÚOOÚ) in their battle — is privacy.
IuRe initiated a petition in September 2008 demanding the deletion of both Opencard holder data and usage data from the system’s central database after the card’s expiration and that the database administrator’s allow users to delete data upon request.
“The RFID-based Opencard (or Praguers’ Universal Card) is now being promoted as an electronic travel card for public transport […] but allows for the movement tracking, especially at the electronic gates which are going to be introduced in Prague metro,” IuRe said on the occasion of European Data Protection Day (Jan. 27, 2010). It’s not just the ‘Big Brother’ aspect of RFID technology tracking people’s movements that is raising concerns.
But it’s not just the “Big Brother” aspect of RFID technology tracking people’s movements that is raising concerns with groups like IuRe. “[The Opencard] contactless chip can be read remotely and the data stored on it can be linked with the central database containing personal data,” the IuRe group said.
It also means — at least for some cards and passports using RFID chips — there’s a chance of electronic snooping and copying.
Electronic pickpocketing
According to some security experts, any common thief can virtually pick your pocket —without actually putting a hand on your wallet or purse — by investing just a couple of thousand crowns into a credit/debit card reader. Although less common in the Czech Republic, RFID technology is widely in use in the United States, leaving 140 million people there at risk for electronic pickpocketing.
To illustrate the inherent risks, in December a crew from the US television station WREG TV followed Walt Augustinowicz, founder of a data protection security service Identity Stronghold as he walked around downtown Memphis, Tennessee. Armed with just a netbook computer and a basic credit card reader he bought on line for $100, Augustinowicz scanned the wallets and purses of 26 passersby in an hour and found that five of them — or nearly 20 percent — had cards with easily readable RFID chips.
“If I’m walking through a crowd, I get near people’s back pocket and their wallet, I just need to be this close to it [less than a meter] and there’s [their] credit card and expiration date on the screen,” Augustinowicz, whose company markets secure sleeves and ID holders designed to block RFID hacking, told the “WREG on Your Side” consumer advocacy program. Thieves can work a crowd using an off-the-shelf card reader, “swipe” credit card numbers and even people’s names.
“There you go. It’s a MasterCard,” said Augustinowicz, after scanning one willing participant’s wallet. “You have a SunTrust card in there,” he explained to a second willing “victim.”
Augustinowicz says that that thieves can easily work a crowd using an off-the-shelf card reader, “swipe” credit card numbers, expiration dates, and in some cases, even people’s names and then e-mail the data anywhere in the world. And while they are harder to hack, passports containing RFID technology — like those of the Czech Republic in place since September 2006 — can also be read, and swiped.
“It gives me a lot of personal information like your date of birth, your photo if I wanted to make some sort of ID,” said Augustinowicz, demonstrating the process with his off-the-shelf reader.
Opencard, open wallet?
Well aware of the perceived security risks, Opencard has on its website a frequently asked questions (FAQs) section with the heading “Biggest Myths and Misunderstandings.” In answer to the question of whether data that is part of Opencard can be read from just a few meters distance — and without the knowledge of the cardholder — the company had this to say:
“Data on the Opencard chip is secured by encryption and by other security mechanisms; it also requires an access code. It is not possible for anyone without the access code to read personal data from the chip, even with the help of a chip reader. Access codes are strictly protected. The strict security precautions prevent leakage of this data. […] Therefore, there is only a very minimal chance that the data would be abused.”
Independent ICT consultant Martin Zikmund, while not professing to be an expert on the security measures specific to the Opencard, agrees that the likelihood of falling victim to electronic pickpocketing is minimal, for a number of factors.
“Firstly, the normal scanners read the RFID chip in the card at a distance of about 30 centimeters, and that’s assuming a line of sight. Special high-performance frame scanners (e.g., security frames in businesses) have a slightly greater reading range (approximately one meter),” Zikmund told Czech Position. “For a smart card inside a wallet, for example, the reading distance drops radically, to a number of centimeters (depending on the position of cards in your wallet and the number of other cards that cover them).”
Moreover, if you are carrying a number of cards with RFID chips that operate in the same frequency band (such as one to access a security door at work, or a students’ ISIC card) its extremely hard to read a single card, Zikmund says. And if you’ve got a mobile phone or keys in the same pocket or handbag, it further complicates chip reading from a distance.‘There are very few (and very expensive) special chips and readers that can recognize individual overlapping RFID chips.’
“There are very few (and very expensive) special chips and readers that can recognize individual overlapping RFID chips,” Zikmund said. “[If] in your wallet there are more RFID cards operating on the same frequency band — of which there are not that many — it is virtually impossible to read their content from a distance. If the RFID chip contains any additional security features (not to mention encryption) the probability of reading the contents of the card without the knowledge of the owner is almost nil.”
