[Fsfe-france] RFID and privacy

[Loic Dachary]

        Hi,

        I'm about to release a Free Software library to dialog with
RFID transponders. It implements the ISO-15693 derivative used by
Texas Instruments readers as a host/reader protocol as well as the
proprietary protocol used by the 6000 series. It is wrapped into an
abstraction designed to allow the addition of other protocols.

        I'm concerned about the possible use of the RFID technology to
harm the privacy of citizens. After a long discussions with people
sharing my concern, we concluded that the best way to counter that
perverse effect was to inform users and developers.

        For that purpose I would like to include the text below at
a prominent place in the documentation and in the interactive parts
of the software. I'd very much appreciate your criticisms. 

        Thanks in advance for your help,

----------------------------------------------------------------------
HELP MAKE RFID USELESS TO BIG BROTHER

The RFID technology is an essential component to implement a world of
total control. Unless citizens and scientists require safeguards, it
can be used by corporations or governments to track and record about
everything. At present (May 2003), this issue is not addressed at all:
corporations are allowed to include RFID tags in any objects they like
and citizens have no way to get rid of them. The standard used to
dialog with a RFID tags (ISO-15693) does not even provide a way to
permanently shut down a RFID tag.

We strongly encourage every citizen, company or government to require
that industry standards are modified to implement safeguards designed
to protect the privacy of every citizen. Statements should be sent to
the standardization group (http://www.wg8.de/) but there is no open
mailing list for this group. The editor of ISO-15693-3 is Alain
Berthon (address@hidden). The webmaster of wg8.de and the editor of
ISO-14443-2 is Michael Hegenbarth (address@hidden). The
statements sent should be friendly : the editors of the standards are
our allies, not our enemies. The editors could use well written
statements to push for functionalities protecting privacy but
aggressive letters would be useless to them. Please cc: every
statement to the address@hidden public mailing list for
archive (http://mail.nongnu.org/archive/html/rfid-privacy/)

The "RFID tags: Big Brother in small packages" article by Declan
McCullagh (http://news.com.com/2010-1069-980325.html) is good
introduction to the problem. The conclusion is as follows: "First,
consumers should be notified--a notice on a checkout receipt would
work--when RFID tags are present in what they're buying. Second, RFID
tags should be disabled by default at the checkout counter. Third,
RFID tags should be placed on the product's packaging instead of on
the product when possible. Fourth, RFID tags should be readily visible
and easily removable."

-- 
Loic   Dachary         http://www.dachary.org/  address@hidden
12 bd  Magenta         http://www.eucd.info/      address@hidden
75010    Paris         T: 33 1 42 45 07 97          address@hidden
        GPG Public Key: http://www.dachary.org/loic/gpg.txt