Driver records: Balancing safety and privacy needs

RFID for humans: the spying and prying problem

Trucking, unlike many other industries, has become very accustomed to using technology for gathering and sharing information, tracking vehicles and cargo, monitoring driver performance, paying tolls, controlling access to restricted areas and numerous other daily business operations. So it is no wonder that the technology and privacy controversies that blow through the consumer sector like summer storms so often pass this technology-savvy business by.

Recent concerns over the possible use of RFID (radio frequency identification technology) tags for human identification and tracking, however, may hit closer to home, especially for carriers transporting hazardous or high-value cargo, food or medicine, where the growing pressures to make sure that the authorized driver is hauling the correct cargo with the assigned tractor to the proper destination are greatest.

The basics of the problem are detailed in a 15-page draft report called “The Use of RFID for Human Identification,” prepared by the Department of Homeland Security (DHS) Emerging Applications and Technology Subcommittee for the Full Data Privacy and Integrity Advisory Committee (www.dhs.gov/dhspublic/interweb/assetlibrary/privacy_advcom_rpt_rfid_draft.pdf). While the report acknowledges the considerable benefits of RFID technology for tracking material, it finds that the use of RFID for human identification “offers little benefit when compared to the consequences it brings for privacy and data integrity. Instead, it increases risks to personal privacy and security, with no commensurate benefit for performance or national security. Most difficult and troubling is the situation in which RFID is ostensibly used for tracking objects (medicine containers, for example), but can be in fact used to monitor human behavior….for these reasons, we recommend that RFID be disfavored for identifying and tracking human beings.”

“What? How would someone do that anyway? And why?” a law-abiding citizen might well ask. The report addresses those concerns with a sobering catalog of potential RFID problems and crimes, including problems resulting from the fact that individuals carrying RFID-tagged documents or items would have a difficult time determining what information is actually available on a tag or when they are being scanned and by whom, even when the tag is being used as intended.

Their list of potential unintended (read criminal) uses of RFID technology is even more sobering, including “skimming,” “eavesdropping,” “counterfeiting or cloning” and “replay.” Both skimming and eavesdropping have to do with the security of radio transmissions. Skimming refers to creating an unauthorized connection with an RFID tag in order to gain access to its data, while eavesdropping is the interception of the electronic communication session between an RFID tag and an authorized reader in order to gain access to the data being transmitted.

Counterfeiting or cloning is just what you'd expect: Someone produces an unauthorized copy of a legitimate tag. Replay is also just as it sounds: a valid transmission is repeated, either by the originator or by an unauthorized person who intercepts it and retransmits it.

Besides the long list of potential problems relating to using RFID tags to identify humans, the DHS report also points out an obvious fact that is perhaps not really so obvious at all. While RFID is a rapid way to read data, it cannot reliably identify individuals unless it is tied to some sort of biometric authentication. For fleets and others, this probably raises another list of questions about the value of all kinds of current ID programs in enhancing security. But DHS report writers declare these to be outside the scope of their inquiry.

It is not only government committees that are considering RFID and privacy issues, however. On August 8, 2006, for example, Australian IT (http://australianit.news.com) reported that a privacy researcher in the Netherlands had developed a portable device, dubbed the RFID Guardian, designed to hijack RFID signals. “I spend most of my time making the RFID industry's life miserable,” researcher Melanie Rieback was quoted as saying. “I'm not anti-RFID. It has the potential to make people's lives easier, but it needs to be used responsibly.”

Ms. Rieback's remarks may have been news to her immediate audience, but she was not telling the trucking industry anything it hasn't known for a very long time — that most technologies have their right and proper uses and attendant benefits, as well as their problems, and that it takes smart and responsible humans to make the right decisions about where and how to deploy them.