News & Commentary

Remember in the movie, Minority Report, when the characters walked by a billboard and it changed to target the advertisement to that particular person or walked into a store and over the loudspeaker, it welcomed them and asked how they liked those pair of pants that had been purchased? That future is starting to become a reality with the use of RFID tags in products and not without serious privacy and security concerns.

Despite reports of the privacy and security problems of the Nike+iPod Sport Kit, companies and consumers continue to experiment with RFID. Sprint has developed two RFID applications based on customer loyalty cards that can identify a customer as he or she walks through a store. Microsoft is reported to have developed an active RFID system that can match your clothes or provide recipes based on the presence of ingredients. In January, MINI (the car maker) began to use RFID tags to conduct a targeted marketing campaign called "Motorby."

MINI installed interactive digital billboards in 4 U.S. cities, Chicago, Miami, New York and San Francisco (you can see one in San Francisco on I-80 approaching the Bay Bridge) and invited a few hundred MINI owners in these cities to join their pilot targeted advertisement campaign. The owners sign up on the MINI website (and answer a survey providing information about themselves) and MINI sends them a RFID key fob. When the MINI owner drives by the billboard, it displays a targeted message, such as "Looking good today, Scooter." If the pilot program is successful, MINI plans to expand the number of billboards in more cities and allow every owner to participate.

This advertising program raises some of the same security concerns as the Nike tracker. According to the program FAQ in the invitation email, no personal information is contained on the key fob. However, the key fob must contain some unique identifier that is linked to personal data in a MINI customer database. MINI also claims that only the MINI readers can trigger the key fob, but there have been plenty of examples of RFID cards being copied from a distance of a few feet or with commercially-available technology costing less than $100. See the IO Active handheld cloner. Just like with the Nike tracker, it isn't hard to imagine others tracking individuals using the RFID key they carry around with them. In addition, assuming the billboards accumulate logs of when each driver passes by that billboard, which begs the question: what kind of access will law enforcement (or even private third parties) have to that data?

Joan Walsh, editor in chief of Salon.com who was a plaintiff in the case, said that parents, not the government, should control children's access to information and ideas. "Whether minors should read Salon is a question for their parents, not the government."

COPA "wo

Twenty-eight states across the nation have already come to the realization that Real ID is a really bad idea. A growing bipartisan rebellion against Real ID is currently un

The ACLU of Northern California has been very active in highlighting the need for privacy and free speech safeguards in municipal wireless programs. Cities should not be deploying wireless networks that track who we are, what we are looking at, and where we are looking at it from. Once that information is collected, who knows where it will end up or how it will be used or abused?

But municipal wireless programs are not the only wireless services lacking in proper privacy and security protections for personal information. Many of us rely on hotel, airport, coffee shop and other private wireless services in our daily lives without considering whether and how our use of those services is being monitored.

Some users of hotel wireless services noticed some strange behavior when surfing the web through their hotel internet connection. Some investigating on their part revealed that their hotel was tracking the websites they went to and even contained identification information connecting them to that web-browsing. These hotels are probably not the only businesses providing "free" (or paid) wireless access in exchange for personal information. Superclick Networks, which provides high speed internet access for hotel guests and specialty IP services to the hospitality industry, even advertises that hoteliers can "deliver targeted marketing and brand messages to guests and users on their network." This targeted marketing is very similar to what Google and Earthlink will be able to do in the proposed San Francisco municipal wireless service.

Google To Anonymize.

Google will begin removing one fourth to half of each IP address after 18 months to 2 years to anonymize user data.

The government has been asking ISPs to hold data for a year or more. Read more about it here and here.

My question is how long Google was actually keeping data before and is this new policy really a privacy enhancing move or is Google actually capitulating to government requests to keep more data for longer?

The American Civil Liberties Union of Northern California, today, called on lawmakers to push for a major overhaul of the Real ID Act, calling it a "real nightmare" for Californians. The Department of Homeland Security's recently proposed delay for implementing the act would do nothing to prevent a national identity card system that violates personal privacy and increases identity theft, all while creating bigger bureaucratic messes, longer lines, and higher fees at the Department of Motor Vehicles.

HID Global Corporation has threatened to sue IO Active, a computer security company based in Seattle, with patent infringement if it gives its planned presentation at the BlackHat Convention this Wednesday, February 28, 2007, in Washington D.C. The presentation discusses vulnerabilities of HID RFID cards and demonstrates a handheld RFID cloner developed by the company to highlight these vulnerabilities.

On Wednesday, January 31, the Montana House passed an anti-REAL ID bill on a vote of 99-1. The bill is expected to head to the Senate next week. The text of the bill can be found here.

For more information about the Maine resolution rejecting Real ID, please visit Real Nightmare and the National ACLU website.

For more information about SB 30, please visit our Technology and Civil Liberties Page at Don't Chip Our Rights Away!