What You May Not Know About RFID

By Dotty Griffith Public Education Director High school students in Spring and Santa Fe independent school districts (near Houston) are being asked to wear tracking devices that may present security risks. Known as RFID (Radio Frequency Identification) chips, the devices are implanted into student IDs. School officials say the chips track attendance and help districts “recapture” monies that would be lost if a student is mistakenly left off the attendance roll. State funding is based in part on attendance. The American Civil Liberties Union of Texas urges parents to ask questions about this technology. Are the cards encrypted to prevent the information from being “skimmed” (read) or copied? Without real security, RFID chips could make students more vulnerable to tracking, stalking, and kidnapping. Someone who wants to do harm could potentially sit in a car across the street and scan student IDs without teachers, school officials, parents, or students ever knowing that any information has been read. And if this information can be read, it can be copied easily to a duplicate chip. A student could be taken off campus while the duplicate chip continues to tell RFID readers that the student is safely at school. Unintended consequences such as this raise the question: Is the value of RFID worth the risk? Parents should be given clear information about RFID technology and the potential privacy and safety risks of an RFID attendance system and be able to opt out if they don’t want their children subject to this technology. Parents should ask the following questions if RFID is proposed at their students’ schools:

• What security measures are in place on the RFID chips? Does the RFID system use encryption and authentication so that my child cannot be tracked by someone who wants to harm her?
• What is the cost of this system? And where is the money coming from to pay for this system?
• Has the school considered a contact chip or bar code system that would not allow my child’s information to be read at a distance?
• How will data collected from the chips be used? How long will it be kept?
• How can I opt out if I don’t want my student exposed to this risk?

While school officials and parents may have been sold on these tags as a “cost-saving measure,” we are concerned that the real price of insecure RFID technology is the privacy and safety of small children. RFID has been billed as a “proven technology,” but what’s actually been proven time and again (PDF) since the ACLU first looked at this issue in 2005 is just how insecure RFID chips can be:

• RFID chips in US passport cards were cracked and copied from a distance of 30-feet using $250 in parts bought from eBay (2009).
• RFID chips used in building access cards across the country were cracked and copied with a handheld device the size of a standard cell phone that was built using spare parts costing $20 (2007).
• California State Capitol RFID-based identification cards were cracked and copied and access was gained to member-only, secure entrances (2006).
• RFID chips implanted in humans were cracked and copied (PDF) (2006).
• The RFID chips used in the Dutch and British e-passport were cracked [pdf] (2006).