There's often a mystique hanging over the head of radio frequency identification (RFID). As soon as you hear the acronym, you immediately get a mental image of covert spies and government surveillance. RFID has that effect because of government development and testing of the technology in its early form. Its birth came directly from testing radar around the 1940s and 1950s, after which decades of testing and refinement came to yield the vast array of uses today.

In case you don't realize it, you're already surrounded by RFID technology. Whether you go to an electronics store to shop or you travel with a passport, it's starting to be embedded in everything around you. Many retail stores are introducing RFID tags to help curb shoplifting, and if your passport is the new e-passport, RFID is being used to assist authorities in identifying you. There are hundreds, if not thousands, of applications of its embedded use, which is exactly why there are so many questions and concerns over the stored information transmitted across the air.

Common Identification Uses

While RFID generally has acceptable uses, such as managing inventory or thwarting shoplifting, it's the personal information being stored on devices for identification purposes that is raising alarms. The United States' e-passport program, launched in late 2006, requires all U.S. ports of entry to be capable of reading data contained on the integrated circuit chip of passports.

The electronic passports are the same as the older passports except that they contain an integrated circuit on the back cover. The chip stores the same data as is displayed visually on paper, but it also contains a biometric identifier in the form of your photograph and a unique chip identification number. The biometric identifier is used in relation to face-recognition technologies deployed at ports of entry.

The major push for use of e-passports is due to Congress legislating that all countries participating in the Visa Waiver Program (VWP) with the U.S. must issue the passports with embedded digital images. With the new passports, the government is promising automated identification, which translates to faster inspections and greater border protection and security. This brings up two interesting questions, though: Can the information be read or captured by someone else? Can the information be easily altered?

If you trust the government's claims, security measures have been taken to prevent anyone from intercepting and reading this information, referred to as "skimming" and "eavesdropping." Skimming occurs when someone in close proximity, "less than 4 inches," to the RFID tag uses a device to gain access to the data. To deter this threat, the government adapted a basic access control (BAC) feature that is similar to a PIN number used at ATM machines. To prevent eavesdropping, they've embedded common public key infrastructure (PKI) technology. An official public key on a reader would be the only way to access the passport.

The government's Web site states, "Characters from the printed machine-readable zone of the passport must be read first in order to unlock the chip for reading." According to this, an official would have to first scan the passport, which would unlock the chip; only then could information be obtained from the RFID device.

Lastly, to protect anyone from skimming information from the card, they've shielded the covers. This protects from unauthorized access from greater distances when the passport cover isn't open. The same technologies are said to protect against altering data on the chips as well.

This and other information can be found on the FAQ section of the U.S. Department of State Web site.

Another example of RFID use is the credit card industry, one of the first industries to adopt RFID technologies. MasterCard promotes the PayPass program with the cooperation of Citibank, and American Express uses the ExpressPay system with its Blue line of credit cards. Offering functionality similar to the new e-passport, these credit cards use the RFID embedded chips to allow customers to swipe their cards near a card reader to pay for goods or services.

The Varying Opinions

While all this sounds like good news, some privacy advocates and security experts have a different opinion. According to some, these tags can be easily read and cloned, offering easy access to forged information. At the Black Hat security conference in August of 2006, even before the U.S. launched its new e-passport, a security consultant from Germany purportedly cracked and cloned an RFID device similar to the U.S. e-passport. This demonstrated that anyone could conceivably forge a passport to gain access into the U.S. by simply making a clone. Also, Avi Rubin, the Information Security Institute Director for Johns Hopkins University, stated seeing only negatives and disadvantages to using RFID technology in this way. He sees uses for it in shipping and inventory applications but not for personal identification purposes.

On a similar note, two U.S. senators, Daniel Akaka of Hawaii and John Sununu of New Hampshire, repealed the Real ID Act of 2005 because of growing concerns of privacy issues. The Real ID Act of 2005 mandates that all U.S. states introduce real-time authentication avenues for driver licenses, birth certificates, and even social security cards. The plan also includes collecting and storing the sensitive information contained on all documents. Akaka stated, "If the new state databases are compromised, they will provide one-stop access to virtually all information necessary to commit identity theft." Both senators are pushing for stricter privacy protection for individuals in relation to RFID uses for identification.

When it comes to credit cards, it's the same as everything else. There are promoters and supporters, and there are those opposing it. Some express deep concerns over the data transmitted over the air, and others argue it's no different from what the magnetic stripe already contains. Security experts have stated it's easy to skim the information off a card, whereas others question how that differs from reading a credit card number over the phone. It's a mixed barrel of many opinions.

With reports like these, it's easy to see how technology might be misused in the future. Many legitimate uses of RFID embedded technology don't include storing personal information, and these types of uses should be embraced. While it sounds like the government and credit card companies have taken quite a few precautions for protecting your privacy, there are still concerns about the possible misuse of your information. It can be scary to think that personal data may be all the more accessible to the criminal element, electronically. At the same time, is the technology really making us more unsafe, or is that just public perception? When you consider just how easy it is to steal someone's identify with only paper documents and receipts, then maybe RFID is getting a bad rap for no reason.

I think everyone understands that no matter how secure and foolproof you attempt to make technology, there will always be those that will abuse and take advantage of it. Given the proper security applications and precautions, RFID will eventually take over common data avenues employed today, making our lives easier and simpler. However, you must continue to be cautious and careful with your private information. Just because something is high-tech doesn't mean you shouldn't be skeptical and cautious about its uses.

Max Hetrick is a PC Support Analyst/Specialist who holds a certification as an MCSA. He also has experience with installation and maintenance of Linux operating systems from the PC to server levels. Max can be reached at This email address is being protected from spambots. You need JavaScript enabled to view it..