California outlaws RFID tag skimming
You looking at my ID?
Ensure Ease of Recovery with Asigra’s Agentless Software
California governor Schwarzenegger has signed a law making the illegitimate reading of RFID tags illegal, but blocked a measure making the unauthorised tracking of kids equally so.
RFID Journal reports that anyone skimming an RFID tag issued by a government agency, health insurance company, employer or library could find themselves in prison for up to a year, or facing a $1,500 fine, though you're OK if you read it by accident, for a medical emergency or if you're a law-enforcement official.
The measure also protects RFID tags issued by schools, which is good, because schools aren't required to tell parents that their kids are being RFID-equipped, thanks to the governor's blocking of law that would have required parental consent.
Anti-skimming laws are popping up all over the place: Washington passed one back in May, and Japan has had anti-skimming legislation since 2005. In many countries computer-hacking laws already cover the illegitimate reading of personal data, even if that data only comprises an identification number, but many of those still need to be tested in court before the legality of such action is known for sure.
The US passport comes with a foil wrapper designed to prevent skimming of the RFID data, but it's been shown to fail if the passport is even slightly open. The UK Passport Office has made no such attempt, making skimming technically easy if allegedly pointless.
The idea is that an RFID tag contains only an ID number, so if someone reads it then there's no problem as they still won't match up with the data connected to that number. The Hacker's Choice recently demonstrated an electronic passport programmed with Elvis' identity - but it's only useful if the immigration staff are relying on the technology to do their job, if the look at the picture they might notice that the carrier is not the long-dead crooner he claims to be.
UK company Peratech has been pushing its quantum-tunnelling technology, able to create a switch with no moving parts, as the solution to skimming/ The user would have to press on a button before the tag would operate, but while that might be feasible for a passport it's a little less practical on an Oyster Card.
California's new law is unlikely to put off serious fraudsters - it's more likely that legislation like this will be used to add weight to a case of actual fraud or theft.
®
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
COMMENTS
Illegal to find if my kids been tagged? screw that!
Setting a baseline for legality is fine, except in this case its illegal for me to find out if my kids been tagged, that's screwed up. I can see it now; teacher overhears the conversation "hey dude, my dad's got this scanner and found out our school id has some chip in it, says its got my birthdate, sex, said its M, glad the old man didn't find Y,and how did the school know..."
Then I find myself talking the mind police
Just friggin great
Invalid test
The terminal THC.ORG used was not a secure Broder Agent's terminal. There would be no reason for an alert to be displayed if the data is forged. The terminal was a standalone device used to ONLY allow you to check your documents to keep you from holding up the queue in the event your passport data somehow has been damaged.
If I put a reader in a public place for anyone to use, I wouldn't attach it to ANY network. I'd just read the data, parse it, and display the data which fits the spec. If you hook a public terminal up to a network and verify the authenticity of the document, take a covert snap from an off-axis, out of view camera, and alert security (but not the document holder) if a forged document is presented, the terminal would be avoided after the first couple of persons get pinched.
The THC test would only be valid at secure terminals connected to a networked database to verify authenticty, then compare data read with data stored. I don't think that THC testers want to push thier skills to the real test.
Re: "They are states children now"
This is of course a perfectly sensible policy. Parents cannot be trusted with their own children; after all they are the ones most likely to abuse them, not the army of paedophiles on the net. Anyone who contests such a thing either does not understand the statistics, has some selfish desire to keep 'their family' together above the welfare of their child, or is a paedophile themselves.
IT infrastructure monitoring strategies
What you need to know about cloud backup
Agentless Backup is Not a Myth
Top 10 SIEM Implementer’s Checklist
Steps to Take Before Choosing a Business Continuity Partner
