text:
|Controller for a security system
|Jamming device against RFID smart tag systems
|Reade et al.
|Method of addressing messages and communications system
|Wood, Jr.
The present application claims the priority of U.S. Provisional Patent Application Ser. No. 60/468,750, filed May 8, 2003 and entitled "The Wildcard-Tag: Selective Jamming for Consumer Privacy," and U.S. Provisional Patent Application Ser. No. 60/471,187, filed May 16, 2003 and entitled "The Blocker Tag: Selective Blocking of RFID Tags for Consumer Privacy," the disclosures of which are incorporated by reference herein.
The present invention relates generally to radio frequency identification (RFID) tags or other types of RFID devices, and more particularly to techniques for providing enhanced privacy in conjunction with the use of such devices.
A conventional RFID tag typically comprises an integrated circuit transceiver capable of transmitting a unique serial number or other identifying information to a nearby reader in response to a query from the reader. Many RFID tags are "passive" in that they do not include a battery or other power source, but instead obtain the power necessary to operate from the query signal itself. RFID tags are expected to replace printed barcodes in consumer product applications. Also, ongoing RFID tag development efforts have led to significant cost and size reductions, which should result in a rapid proliferation of RFID tags into many new areas of use. For example, proposals have recently been made to integrate RFID tags into currency.
The impending ubiquity of RFID tags, however, also poses a potentially widespread threat to consumer privacy. The simplest RFID tag will broadcast its unique identifying information to any nearby reader. The movements of a given consumer or other user can therefore be readily tracked by simply monitoring the RFID tags in goods carried by or otherwise associated with that user.
A number of conventional approaches attempt to address the privacy threats associated with RFID tags.
A straightforward approach for the protection of consumer privacy is to "kill" RFID tags before they are placed in the hands of consumers. More specifically, an RFID tag can be killed upon purchase of the tagged product, by sending a special kill command to the tag. A killed tag is truly dead, and can never be re-activated. As an example, a supermarket might use RFID tags to facilitate inventory management and monitoring of shelf stocks. To protect consumer privacy, checkout clerks would kill the tags of purchased goods, such that no purchased goods would contain active RFID tags. There are many environments, however, in which simple measures like kill commands are unworkable or undesirable for privacy enforcement. For example, consumers may wish RFID tags to remain operative while in their possession, so as to be utilizable by home appliances or other user devices equipped with RFID tag readers.
Another approach involves shielding an RFID tag from scrutiny by enclosing it in a Faraday cage, that is, a container made of metal mesh or foil that is impenetrable by RF signals. RFID tags will inevitably see use, however, in a vast range of objects, including clothing and wristwatches, that cannot be placed conveniently in containers. Faraday cages thus represent at best only a partial solution to the consumer privacy problem.
Active jamming of RF signals is another, related physical means of shielding RFID tags from view. A consumer could carry a device that actively broadcasts RF signals so as to block or otherwise disrupt the operation of any nearby RFID tag readers. This crude approach raises legal issues relating to broadcast power levels, and could cause severe disruption of all nearby RFID systems, even those in legitimate applications where privacy is not a concern.
Another general approach is to make the RFID tags "smarter," so that they interact with readers in a way that better protects privacy, while still providing the desired active functionality. This would typically involve the use of cryptographic methods. More particular examples requiring cryptographic functionality implemented on the tags themselves include the "hash-lock" and "silent tree-walking" techniques described in S. A. Weis et al., "Security and privacy aspects of low-cost radio frequency identification systems," Proceedings of the First International Conference on Security in Pervasive Computing, 2003, and S. A. Weis, "Radio-frequency identification security and privacy," Master's thesis, MIT, June 2003. However, the severe cost constraints on basic RFID tags may preclude implementation of such tag-based cryptographic functionality in practical applications.
Other techniques of this type which avoid the need for tag-based cryptographic functionality include the external agent re-encryption technique described in A. Juels and R. Pappu, "Squealing Euros: Privacy protection in RFID-enabled banknotes," Financial Cryptography '03, R. Wright, editor, Springer-Verlag, 2003; and the universal re-encryption technique described in P. Golle et al., "Universal re-encryption for mixnets," 2002. However, these re-encryption techniques require significant computational infrastructure external to the tags, and are thus likely to be unduly burdensome in practice.
It is therefore apparent that a need exists for improved techniques for providing cost-effective consumer privacy protections in practical RFID tag applications, in such a manner that the legitimate tracking capabilities of the tags are not undermined, and without requiring the use of tag-based cryptographic functionality or additional computational infrastructure external to the tags.
The present invention in accordance with one aspect thereof provides techniques for enhanced privacy in an RFID system. The RFID system generally includes a plurality of RFID devices, each having an associated identifier, and at least one reader which communicates with one or more of the devices. A blocker device is operative to receive a communication directed from the reader to one or more of the RFID devices, and to generate, possibly based on information in the received communication, an output transmittable to the reader. The output simulates one or more responses from at least one of the RFID devices in a manner which prevents the reader from determining at least a portion of the identifier of at least one of the RFID devices. The blocker device may itself comprise one of the RFID devices, and thus may have one of the identifiers associated therewith.
In an illustrative embodiment, the output generated by the blocker device interferes with the normal operation of a singulation algorithm implemented by the reader, by selectively blocking the reader from singulating certain device identifiers in a designated privacy zone or in accordance with a specified privacy policy. The singulation algorithm may be a tree-walking singulation algorithm, an ALOHA singulation algorithm, or any other type of singulation algorithm utilizable by a reader in determining particular device identifiers.
Advantageously, an RFID device or other blocker device configured to include a selective blocking feature in accordance with the invention provides enhanced consumer privacy, without significantly undermining the effectiveness of the device as a tracking mechanism prior to consumer possession thereof. Moreover, such protection is provided in a particularly cost-effective manner, without significantly increasing the complexity of the RFID devices or the device reader.
These and other features and advantages of the present invention will become more readily apparent from the accompanying drawings and the following detailed description.
FIG. 1 is simplified block diagram of an example RFID system in which the present invention is implemented.
FIG. 2 illustrates one possible implementation of an RFID device reader of the FIG. 1 system.
FIG. 3 shows an example of a tree-walking algorithm utilizable in an illustrative embodiment of the invention.
FIG. 4 illustrates the manner in which a privacy zone can be created in the tree-walking example of FIG. 3 utilizing the techniques of the invention.
FIGS. 5, 6 and 7 are flow diagrams of example processes for implementing selective blocking with specified privacy zones in the RFID system of FIG. 1.
The present invention will be described herein with reference to an exemplary RFID system in which multiple RFID devices communicate with an RFID device reader. It is to be appreciated, however, that the invention is not restricted to use in this or any other particular RFID system configuration.
The term "RFID device" as used herein is intended to include an RFID tag or any other type of device configurable for transmission of device-identifying information via radio frequency communications. Although the following description will refer primarily to RFID tags, it is to be understood that the techniques disclosed are more generally applicable to other types of RFID devices.
The device-identifying information may be a serial number or any other type of identifier, also generally referred to herein as an ID. It should be noted that not every identifier in a given set of unique identifiers need have a corresponding realized device.
The term "blocker device" as used herein is intended to include a blocker tag or other RFID device, or more generally any other type of device, which incorporates full or selective blocking functionality in accordance with the invention. A blocker device may therefore be an RFID tag or other RFID device configurable for transmission of device-identifying information via radio frequency communications, or may be another type of device which is not so configurable or does not otherwise have an identifier associated therewith. For example, a blocker device may comprise a mobile telephone, a portable computer, a personal digital assistant (PDA), a hardware-based authentication token such as an RSA SecurID™ token commercially available from RSA Security Inc. of Bedford, Mass., U.S.A., or any other type of processing device in which full or selective blocking functionality in accordance with the invention may be implemented.
The term "reader" as used herein is intended to include any type of device capable of interacting with an RFID tag or other RFID device so as to receive device-identifying information therefrom.
FIG. 1 shows an RFID system 100 in which the present invention is implemented. The system 100 includes a number of RFID tags 102, more particularly denoted T1, T2, . . . Tn, and an RFID reader 104. The notation T1, T2, . . . Tn is also used herein to refer to the particular tag IDs of the tags 102. The reader 104 communicates with the tags 102 and receives identifying information therefrom, utilizing the techniques of the present invention. The reader 104 is coupled via a network 106 to servers denoted 108, 110.
In accordance with an aspect of the invention, one or more of the tags 102 are configured with an ability to block the operation of a singulation algorithm utilized by the reader 104 in order to provide enhanced privacy for a user of the tag. A given tag configured in this manner is referred to herein as a "blocker tag." The manner in which such tags interfere with the operation of the reader 104 will be described in greater detail below.
The network 106 may represent a global computer network such as the Internet, a wide area network (WAN), a local area network (LAN), a satellite network, a telephone or cable network, or various portions or combinations of these and other types of networks. The servers 108, 110 may be conventional processor-based information processing devices of a type conventionally utilized in conjunction with RFID readers in an RFID system.
The particular number n of tags 102 in the system 100 is purely arbitrary, and the system can be configured to support any desired number of tags. Also, although only a single reader 104 is shown in the figure for simplicity and clarity of illustration, the system will typically include multiple readers. Furthermore, it should be noted that a given reader need not be connected to a network, and may instead operate as a stand-alone device.
FIG. 2 shows one possible implementation of the reader 104 of the FIG. 1 system. The reader in this implementation includes a processing block 200, comprising a processor 202 coupled to a memory 204, a network interface 206, an RF transceiver 210, and an antenna 212. One or more of these elements may be implemented in whole or in part as a conventional microprocessor, digital signal processor, application-specific integrated circuit (ASIC) or other type of circuitry, as well as portions or combinations of such circuitry elements. Software programs for controlling the operation of the reader 104 may be stored in the memory 204 and executed by the processor 202.
As indicated previously, the present invention in accordance with one aspect thereof implements one or more of the tags 102 as blocker tags. Such tags are configurable to disrupt the normal operation of the reader in a manner that provides enhanced privacy protection without undermining the effectiveness of the tags as a tracking mechanism prior to consumer possession thereof. This is achieved in the preferred embodiments by selectively interfering with a singulation algorithm implemented by the reader.
A given RFID tag in accordance with the invention generally includes circuitry comprising memory, processing logic and an RF transceiver. These elements may be configured in a manner similar to that used in conventional RFID tags, with straightforward modification to implement a blocking technique as described herein.
A typical RFID reader is generally only able to communicate with a single RFID tag at a time. If more than one tag responds to a query by the reader, the reader detects a collision and executes a singulation algorithm which allows the reader to communicate with the conflicting tags one at a time.
Conventional RFID tag systems typically operate at a frequency of either 13.56 MHz or 915 MHz. Those operating at 915 MHz commonly utilize a tree-walking singulation algorithm, while those operating at 13.56 MHz usually utilize an ALOHA singulation algorithm. Other frequencies, such as 125 kHz and 2.45 GHz, are also used, and employ similar singulation algorithms.
The blocking techniques of the present invention will initially be described with reference to an illustrative embodiment in which the reader 104 is assumed to utilize a conventional tree-walking singulation algorithm to determine the ID associated with a particular RFID tag.
Examples of selective blocking in this tree-walking singulation context will be described in conjunction with FIGS. 3, 4 and 5. Other embodiments of the invention, based on an ALOHA singulation algorithm, will then be described in conjunction with FIGS. 6 and 7.
The tree-walking singulation algorithm enables the reader 104 to identify the IDs of nearby tags individually by means of a bit-by-bit query process resembling a depth-first search of a binary tree.
Assume that the tags 102 in the system 100 of FIG. 1 bear unique IDs of a fixed bit-length k. Example values of k include 64, 96 or 128, although any value can be used.
Let ∥ denote the concatenation operator for bit strings.
The set of all possible k-bit IDs can be viewed as the leaves of a standard binary tree of depth k. The root of this tree has depth 0 and is labeled with the empty string. A node of depth d is labeled with a binary string x of length d; if d<k, then the node has two children at depth d+1: a "left child" with label x0, and a "right child" with label x1. (Here x0 means x ∥ 0 and x1 means x ∥ 1.)
We regard the branches of a given node in this tree as bearing labels '0' and '1', associated with the respective left and right branches. Thus a node at depth d in this tree may be uniquely identified by a binary prefix B=b1b2 . . . bd,representing the sequence of branch labels of branches traversed in a path from the root to the node. It follows that each of the 2k leaves in the tree has a unique associated k-bit string. We view each such leaf as representing a distinct possible tag ID.
The tree-walking singulation algorithm is a recursive depth-first search performed by a reader 104 in the following manner.
Let the subtree of a given node of the tree denote all the descendents of that node in the tree.
The reader initiates the tree-walking singulation algorithm at the root of the tree.
Starting at a given node B=b1b2 . . . bd, the reader queries all tags bearing IDs in the leaves of the corresponding subtree, i.e., all tags whose IDs bear the prefix B; all other tags are instructed to remain silent.
The queried tags reply to the reader with the d+1-st bit in their IDs; i.e., each tag broadcasts a '0' if it lies in the left subtree of the node B, and a '1' if it lies in the right subtree. Consequently, if there are tags in both the left and right subtrees of B, then the tags together simultaneously broadcast both a '0' and a '1', creating a collision in the broadcast bit.
In this case, when a collision is detected, the reader recurses (sequentially in turn) beginning at its child nodes B ∥ 0 and B ∥ 1.
If, on the other hand, the tags all reply with only a single bit b, i.e., they all lie in the same subtree, then the reader recurses on the node B ∥ b, and ignores the other (empty) subtree.
When the algorithm reaches a leaf (at depth k), it outputs the associated k-bit sequence, which is the ID of the tag just read. The full output of the singulation algorithm is a list of the IDs of all tags within range.
The running time of this singulation algorithm is bounded by the product of k and the number of tags being read.
It should be noted that the particular tree-walking algorithm described in detail above is simply one type of tree-walking algorithm that may be utilized in conjunction with the invention. Numerous variants of this particular tree-walking algorithm, as well as other types of tree-walking algorithms, may also be used. For example, one such variant may involve transforming the order of the identifier bits using a fixed permutation. This would help reduce the number of collisions in initial bits, since unique identifiers carry more randomness than, e.g., product identifiers.
FIG. 3 shows a simple example illustrating the operation of the particular tree-walking singulation algorithm described in detail above. The binary tree shown in the figure is of depth 3, and has 23=8 unique tag IDs represented at its leaves. The prefixes associated with subtrees are denoted in italics.
In this example, we consider three tags as being present, namely the '001', '011' and '110' tags. These are indicated by large black circles at their respective leaves.
The tree-walking singulation algorithm here first singulates the '001' tag. It does this by following the path denoted by the darkened edges. At two nodes, namely the root of the tree and the root for all tags with a '0' prefix, there are collisions in the bits broadcast by the tags, because there are tags present in both the left and right subtrees. We denote these collision-points with hollow circles. Singulation of the '011' and '110' tags would follow by recursion on the collision points.
A property of the tree-walking singulation algorithm is that all tags whose IDs share a common prefix lie in a common subtree.
Thus, for example, if all products produced by a particular manufacturer share a common prefix, all IDs on tags for products of that manufacturer lie in a common subtree. These IDs are all scanned sequentially by the tree-walking singulation algorithm.
More generally, different ID prefixes may correspond to different zones of the space of possible IDs. For example, all IDs beginning with a '1' may be viewed as being in a "privacy zone," or all IDs beginning with '010' may be viewed as being in a "recycling zone." The careful allocation of ID prefixes allows the establishment of multiple zones of IDs that may be utilized in conjunction with the selective blocking techniques of the invention, as will be described in greater detail below.
As mentioned previously, one or more RFID tags, referred to herein as blocker tags, are configured to deliberately interfere with the tree-walking singulation protocol. A blocker tag in the illustrative embodiment does not engage in an active form of jamming. Rather, by participating in the tag-reading process in a non-compliant way, it performs what may be thought of as a kind of passive jamming.
In one possible implementation, a given blocker tag simulates the full spectrum of possible tag IDs, thereby obscuring the IDs of all tags. The blocker tag in this case effectively overwhelms the tree-walking singulation protocol by forcing it to sweep the full space of all possible tag IDs, which is extremely large.
More specifically, a basic blocker tag of this type simulates the full set of 2k possible tag IDs, and is also referred to herein as a full blocker tag or a universal blocker tag. Such a blocker tag, when carried by a consumer, creates a physical region of privacy protection in which a reader is incapable of singulating tags.
In operation, whenever the reader queries the tags in the subtree of a given node B for their next bit value, the full blocker tag simultaneously broadcasts both a '0' bit and a '1' bit. This may be accomplished, for example, by equipping the blocker tag with two distinct antennae, or using other suitable transmission mechanisms. These and numerous possible implementations of the blocker tag will be readily apparent to those skilled in the art given the teachings provided herein. The forced collision directs the reader to recurse on all nodes, thereby causing the reader to explore the entire tree.
If the reader had enough time, memory, and processing power to complete the tree-walking singulation algorithm in these circumstances, it would output the entire set of all 2k possible tag IDs. However, this set is very large, and the reading process is designed to execute very rapidly. In practice, therefore, the reader may be expected to stall after reaching only a few hundred leaves in the tree. The net effect is that the full blocker tag "blocks" the reading of all tags.
In other implementations, a blocker tag in accordance with the invention may be configured to prevent singulation across certain restricted ranges of tag IDs. Thus, it is possible to designate a particular zone, that is, a range of IDs, such as all those with a leading '1' bit, as subject to the privacy protection of the blocker tag. Such a blocker tag is referred to herein as a selective blocker tag or a partial blocker tag. As will be shown below, this selective-blocking feature may be used to protect items in the hands of consumers, while at the same time permitting unimpeded reading of tags in commercial environments.
FIG. 4 illustrates how such a privacy zone can be created in the k=8 example of FIG. 3. The tree structure shown in FIG. 4 is the same as that of FIG. 3. However, in the FIG. 4 arrangement, a privacy zone is created in the right subtree of the root node. The privacy zone is created by configuring the selective blocker tag such that it replies to the reader only during that portion of the execution of the tree-walking singulation algorithm that corresponds to the right subtree of the root node. This selective-blocking feature would have the effect of obstructing only the reading of tags that bear a '1' prefix in their IDs, while tags having IDs that begin with a '0' bit could be read without interference. A selective blocker tag can thus target a particular zone for protection.
Also, a given tag can be transferred from outside the privacy zone into the privacy zone, for example, upon purchase of a corresponding tagged item by a consumer. This transfer process is also illustrated in FIG. 4, which shows the '011' tag being transferred into the privacy zone by flipping its first bit from '0' to '1'.
Transfers may also be made from within the privacy zone to outside the privacy zone, in a similar manner.
Such transfers may be controlled through use of a personal identification number (PIN), a password, a cryptographic authentication mechanism, or other suitable technique.
FIG. 5 is a flow diagram showing an example selective blocking process implemented in the system 100 using the techniques of the invention.
In step 500, reader 104 issues a query for an ID subset S in conjunction with a tree-walking singulation algorithm of the type previously described. A given one of the RFID tags 102 configured as a selective blocker tag having a privacy zone P then performs the operations shown in steps 502, 504 and 506. In step 502, the selective blocker tag determines if the intersection of S and P is the empty set. If so, the selective blocker tag makes no broadcast, as indicated in step 504. Otherwise, the selective blocker tag simulates a bit collision in step 506 by broadcasting both a '0' and a '1'.
Advantageously, a given selective blocker tag may be easily and inexpensively configured so as to block reading of all tag IDs with an arbitrary prefix or set of prefixes. More generally, a selective blocker tag may be designed to simulate, and thus block the reading of, tag IDs satisfying any of a number of specified conditions, such as those matching a given regular expression.
It should also be noted that a full or selective blocker tag may be used in a malicious manner, namely as a tool for mounting denial-of-service attacks. Such a blocker tag might be a full blocker tag that shields the full spectrum of IDs from reading, or might be a selective blocker tag that targets a particular range, for example, the set of IDs assigned to a particular manufacturer. A malicious blocker tag of this type might be used to disrupt business operations or to help perpetrate petty theft by shielding merchandise from inventory-control mechanisms. A number of techniques for detecting the presence of a malicious blocker tag will be described elsewhere herein.
Another issue that arises in the selective blocker tag context is that blocking certain zones may automatically lead to the inadvertent blocking of other zones. For example, if IDs beginning with '0' are blocked, then the reader may never get around to reading IDs beginning with '1'. Therefore, it may be preferable in certain applications to provide a mechanism for informing the reader not to attempt to read within certain subtrees. That is, the reader needs to know when a subtree is being blocked, so that it can proceed to other parts of the tree without stalling on the blocked subtree.
A number of different techniques may be used to configure the tree-walking singulation algorithm such that it works efficiently even in the presence of selective blocker tags. Generally, such techniques configure the tree-walking singulation algorithm such that it ignores subtrees that are being blocked.
For example, when at a given node, the basic tree-walking singulation algorithm asks all tags corresponding to leaves in the subtree of that node to broadcast their "next bit," that is, the label on the next branch from the node towards the leaf in question. The basic algorithm may be augmented in accordance with the invention such that the reader first determines for a given node whether the subtree rooted at this node is being blocked. Such a determination could be made via an appropriate query generated by the reader. More specifically, the reader may in effect pose the special query: "Is the subtree rooted at this node being blocked?" If the subtree is not being blocked, then the reader would proceed to ask the standard next-bit question.
This aspect of the invention is referred to herein as "polite blocking," since the selective blocker tag is being polite by informing the reader as to which subtrees are being blocked.
Another form of polite blocking configures a given selective blocker tag to inform readers as to the particular selective blocking policy being implemented. This technique may make use of a small, designated range of "virtual" tag IDs t, t+1, . . . , t+k, each corresponding to one of a range of standard, pre-specified policies labeled 0, 1, . . . , k. In order to indicate that it is implementing privacy policy i, a selective blocker tag can simulate the presence of a tag with ID t+i. Such unary representation of policy numbers allows a reader that encounters multiple selective blocker tags to decipher the full policy set.
This policy announcement approach is generally only viable for signaling one of a relatively small set of pre-established privacy policies. It is particularly well suited for use with a small number of designated privacy zones. In general, policy announcement is less flexible than the approach of permitting any node to declare that its subtree is protected. On the other hand, it may be important not to allow selective blocker tags to implement an indiscriminately rich set of privacy policies, as a policy can then become a unique identifier, or at least distinct enough to undermine the policy of its bearer.
An important advantage of the blocker tag approach of the present invention is its very low implementation cost. The blocker tags themselves generally may be implemented using otherwise conventional RFID tags with only very slight circuit modifications to implement the functionality described above. Moreover, the tags do not require any cryptographic functionality. No significant modifications to existing consumer-product RFID tags are required. The only significant overhead costs are those associated with management of a password for each standard RFID tag, to authorize it to change privacy zones. Thus, the blocker tag approach has low overhead costs, comparable to those associated with the "kill" command approach, but is much more flexible and useful for protecting privacy.
To ensure its attractiveness as a widespread tool for protection of consumer privacy, the blocker tag will preferably create little or no disruption of normal RFID-based commercial processes like inventory control. In this context, a full blocker tag would generally be counterproductive in that it would provide privacy protection, but at the cost of indiscriminately disrupting all RFID-tag reading in its vicinity. Selective blocker tags avoid this problem, and are therefore a preferred implementation of the invention.
With the use of privacy zones in conjunction with dynamic alteration of tag IDs, it is possible to implement a range of privacy policies that simultaneously satisfy the needs of consumers and businesses. As indicated previously, tag IDs may be transferred inside or outside privacy zones depending upon the situations in which they are used.
In a simple implementation of a selective blocker tag, the privacy zone comprises the subtree of a single node, and thus corresponds to a set of IDs having a common binary prefix. An example of such a privacy zone comprising the right half of the tag ID tree, namely all serial numbers whose leading bit consists of a '1', was previously described in conjunction with FIG. 4. The following example illustrates in greater detail how a privacy zone of this type might be used in a retail setting.
Privateway Supermarkets makes use of selective blocker tags whose privacy zone consists of all IDs with a leading '1' bit. Packages in Privateway Supermarkets each bear an RFID tag with a unique ID used for purposes of inventory control. As initially programmed, and while an item is inside the supermarket or its warehouses, the tag ID carries a leading '0' bit. At this point, the selective blocker tags do not disrupt the ordinary reading of other tags.
When the RFID tag reader at a cash register scans an item for purchase by a customer, it also transmits a tag-specific key to the RFID tag on the item, causing the leading bit in the tag ID to flip to a '1'. The key should be secret so as to prevent an attacker from transferring tag IDs arbitrarily into the privacy zone. Privateway Supermarkets also provides its customers with free selective blocker tags. These may be available, for example, embedded in shopping bags at registers, as stickers to be placed on items, or using other suitable mechanisms.
When Alice returns home from her shopping trip to Privateway Supermarkets, she unmasks items in the privacy zone by detaching them from shopping bags or removing their privacy-enhancing stickers. To ensure that stickers no longer perform blocking when removed, they may be constructed to deactivate completely upon removal, for example, by detachment of their antennae. Bags might similarly be equipped with deactivation mechanisms. Personal blocking devices, of course, may be equipped with on/off or policy-setting switches. When the items are placed in a "smart" refrigerator, an attached RFID reader tallies the contents. By keeping track of this inventory, Alice's home computer can print out a list of items for purchase on Alice's next trip to the supermarket.
A technique such as that utilized in Example 1 above could be incorporated into an otherwise conventional EPC system of a type specified by the MIT AutoID center. See, for example, D. L. Brock, "The electronic product code (EPC): A naming scheme for objects," Technical Report MIT-AUTOID-WH-002, MIT Auto . ID Center, 2001, http://www.autoidcenter.org, which is incorporated by reference herein. An EPC comprises 96 bits, sequentially partitioned as follows: (1) an 8-bit header; (2) a 28-bit "EPC-manager" code, designating the organization that owns the tag; (3) a 24-bit "object-manager" code, designating the class of object as determined by the EPC manager; and (4) a 36-bit serial number that uniquely identifies the object.
Thus the privacy technique of Example 1 could be implemented by having one of the bits of the object-manager code designated as a standard privacy bit. All selective blocker tags could then be assigned a unique collective EPC-manager code.
Such an arrangement is reader friendly in that, to determine whether a selective blocker tag is present, a reader would initially check whether the EPC-manager code for selective blocker tags is present by following the corresponding path down the tree. Note that a selective blocker tag would simulate all EPC-manager codes, but a particular one would serve as an agreed-upon indicator of blocking. The privacy bit in the object-manager code for a tag could be flipped on or off according to the policies of the tag EPC manager.
In many cases, it would be useful to have multiple, independent privacy zones. By associating different privacy-enhancing practices with different zones, it would be possible to maintain a collection of overlapping privacy policies. Different types of selective blocker tags might then be used to implement a variety of privacy policies. This aspect of the invention will be illustrated using the following examples.
Suppose that the first two bits of tag IDs specify a desired privacy zone ranging from zero to three. Alice might carry a zone-one selective blocker tag in her wristwatch. So as to protect her clothing and personal appliances from scrutiny, all of these items would then be marked with a zone-one prefix.
On the other hand, Alice might like to be able to handle groceries without blocking their tags. In this case, on checkout, her grocery items could be marked with a zone-two prefix, while privacy stickers for these items carry zone-two selective blocker tags. Thus, when the stickers are removed, Alice can handle them without her wristwatch blocker tag interfering with the reading process. Alice might choose, on the other hand, for her automobile to implement the strongest level of protection, blocking RFID tag reading in all four zones.
As indicated previously, proposals have been made to embed RFID tags in currency. Using the techniques of the invention, IDs for these tags might be relegated to a special privacy zone for currency.
To protect the privacy of consumers, then, wallets could be equipped with embedded selective blocker tags or with credit-card-like devices bearing selective blocker tags.
The presence of a currency-zone blocker tag would be easily detectable, as will be described below. Thus, in sensitive locations like airports, law-enforcement officials could take the approach of temporarily sequestering wallets in Faraday cages during security checks. They could then detect the presence of suspicious currency-zone blocker tags. In the absence of such tags, or following their identification and removal, it would be possible to monitor large and suspicious currency flows. The particular policies are obviously a subject for debate. However, the selective blocker tags of the present invention allow one to consider a range of policies that was heretofore unattainable.
Law-enforcement officials would also be able to scan banknotes quickly and without impediment when they pass through financial institutions.
As indicated above, RFID tags in consumer items may be configured in accordance with the techniques of the invention so that their IDs and other highly individual data can be transferred to a privacy zone. At the same time, to facilitate recycling, tags on plastic items might carry and readily broadcast their polymer-type number, for example, a value that ranges between 1 and 7. This could be accomplished, for instance, by having a special class of RFID tags used uniquely for recycling.
A privacy risk in this approach is the effect of "clustering." In particular, the polymer numbers for a multiplicity of objects would together constitute a unique identifier. However, most common consumer items made of recyclable plastic, such as soda bottles, do not remain with a consumer in large quantities for very long.
Another possible use of multiple privacy zones, apart from the arrangements described in the foregoing examples, is in providing protection against spillover effects from selective blocker tags. For example, if Alice is carrying a selective blocker tag and standing in physical proximity to Bob, then her blocker tag may extend its disruptive effects to the reading of tags carried by Bob. While Bob may be carrying tags whose IDs lie in a privacy zone, he may wish to have full control over the circumstances in which they are shielded.
Given a reasonably large collection of privacy zones, for example, on the order of 100, every person might make use of a selective blocker tag protecting a fixed, random zone, and have his or her items marked accordingly. This would reduce the likelihood of spillover.
It is important to note that there is a tradeoff between individual privacy and the number of possible privacy zones or associated policies. At an extreme, if each blocker tag were to implement a unique policy, then the policy itself would constitute a unique identifier. Thus, the set of possible privacy zones or associated policies in a given RFID system should not be so large as to risk undermining the desired privacy protection.
Selective blocker tags in accordance with the invention may be made available from many sources. For example, merchants may include them for free with purchased goods, or consumers may be able to buy them at the checkout counter. Consumer rights organizations may supply them to consumers for nominal cost. The low implementation costs ensure that selective blocker tags may be cheaply and widely available.
As noted above, blocker tags may be used in a malicious manner, namely as a tool for mounting denial-of-service attacks. For example, a blocker tag may be misused to circumvent an intended RFID reader for illegitimate purposes, through its ability to simulate multiple tag IDs. While legitimate privacy applications of the blocker tag also simulate multiple tag IDs, the malicious blocker tag does not respect the boundaries of an allowed privacy zone.
RFID readers can be designed to cope with the intended blocker behavior within the privacy zone, but their basic functionality requires them to be able to read tags outside of this zone. Thus a malicious blocker tag effectively mounts a denial-of-service attack against the RFID reader protocol. Such attacks might be designed simply to disrupt service, or may be part of a scam used by petty thieves.
A malicious blocker tag could attempt to simulate a particular distribution of tags in order to avoid detection. Regardless of this distribution, the number of simulated tags must be large enough to delay significantly the singulation protocol.
Detection of denial-of-service blocker attacks can therefore be implemented in a straightforward manner using a threshold detection approach. In this approach, an attack is assumed to be in progress if the number of perceived RFID tags exceeds some reasonable specified threshold, such as 1,000 tags at a retail checkout line. This threshold detection approach is simple and robust, as it does not rely on the exact behavior of the malicious blocker tag. In other words, this approach would work for either universal or selective blocker tags of a malicious kind.
A more sophisticated detection technique may be implemented based on the use of prescribed tag ID ranges. For example, the reader could be connected to a database listing every valid tag in the range of IDs associated with a particular manufacturer. Such IDs may correspond, for example, to the "EPC manager" in an EPC. A tag having an ID that lies within the range but is not on the list could be identified as fraudulent. If tag IDs are at least partially random, it will be hard for an attacker to guess a valid ID. This defense is also not foolproof. For example, it does not protect against spoofing valid tag IDs that have been recorded previously by the attacker. In practice, this approach would also rely on access to manufacturer databases, which may be impractical in retail settings.
Another possible detection approach is to utilize special-purpose readers to filter out malicious blocker tags. For example, if a few readers working together could estimate the location of the tags, they could ignore a multitude of fake tag IDs originating from a single location. However, such an approach could significantly increase the cost and complexity of the readers.
As was mentioned previously, other embodiments of the invention are based on readers which utilize an ALOHA singulation algorithm. Embodiments of this type will now be described with reference to FIGS. 6 and 7.
The ALOHA singulation algorithm is generally utilized for RFID tags that operate in low frequency ranges, such as the 13.56 MHz range. Use of the ALOHA singulation algorithm in this case aims at reducing reader-to-tag communications in order to meet restrictive electromagnetic compatibility regulations. Additional details regarding an example of a standard implementation of the ALOHA singulation algorithm can be found in MIT AutoID Center, 13.56 MHz ISM band class 1 radio frequency identification tag interference specification: Candidate recommendation, version 1.0.0, Technical Report MIT-AUTOID-WH-002, 2003, http://www.autoidcenter.org, which is incorporated by reference herein. This standard employs a protocol variant known as "slotted" ALOHA in which a given tag broadcasts its ID during a designated, independent time interval known as a "slot."
The operation of the example ALOHA singulation algorithm is as follows. Let Ti denote the ID of a tag i. The function ƒ denotes a general, preprogrammed function for scheduling tag responses. In the above-cited AutoID Center standard, this function ƒ is left unspecified, and presumably may be selected by individual tag manufacturers. The example ALOHA singulation algorithm involves essentially the following steps:
1. The reader broadcasts S, the number of designated slots, and a random value R.
2. Tag i computes a slot value si=ƒ(T1, R, S)ε[0, 1, . . . , S−1].
3. During slot si, tag i transmits Ti to the reader.
In the event of a collision in given slot si, i.e., a simultaneous reply from multiple tags, a reader is in general unable to receive any transmission. In other words, tag transmissions are lost. The ALOHA singulation algorithm aims to avoid such collisions through randomized scheduling of replies and selection of an appropriately large slot allocation S. There are a number of techniques for addressing the problem of collisions. For example, if many collisions occur, the algorithm may be re-run with a larger value S.
An additional feature of the slotted ALOHA singulation algorithm specified by the AutoID Center is referred to as a selection mask. This is a prefix broadcast by the reader to specify a subset of tags that should respond to its query. When a k-bit selection mask σ is specified, a tag only transmits to the reader if σ is an exact prefix of Ti, i.e., matches the first k bits. Also, when a selection mask σ is specified, a tag transmits only the substring of its ID Ti that follows σ. The selection mask is optional, and the absence of a selection mask is denoted herein by a null selection mask φ.
Blocker tags for the ALOHA singulation algorithm may operate according to essentially the same principles as those described previously in the case of the tree-walking singulation algorithm. In particular, an ALOHA blocker tag may be configured to simulate transmission collisions during selected time slots. Two illustrative approaches for producing such blocking behavior in a selective manner will now be described.
In the first approach, a privacy zone P may be specified in terms of a set of arbitrary-length prefixes Σ={σ1, σ2, . . . , σm}. If the reader specifies a selection mask σ such that σi is a prefix of σ or vice versa, then the blocker tag simulates collisions for all slots. Otherwise the blocker remains silent. Note that if Σ is not empty and σ=φ, then the blocker will block all slots.
FIG. 6 is a flow diagram illustrating one possible implementation of this first approach in system 100. In step 600, reader 104 issues a query on a selection mask σ. A given one of the RFID tags 102 configured as a selective blocker tag having a privacy zone P then performs the operations shown in steps 602, 604 and 606. In step 602, the selective blocker tag determines if there exists in the privacy zone P defined by the set of arbitrary-length prefixes an element p having the prefix σ. If so, the selective blocker tag makes no broadcast, as indicated in step 604. Otherwise, the selective blocker tag simulates a collision in step 606 for all time slots.
As a more particular example of the first approach, assume that Σ={'0', '11'} for a given blocker tag. This tag will block the reading of all tags whose ID Ti has a leading '0' bit or the leading pair of bits '11'. Thus, if the reader specifies any of the following selection masks, for example, then the blocker will be activated: '0', '1', '01', '110', φ. In contrast, if the reader specifies any of the following example selection masks, then the blocker will remain silent: '11', '110', '11000'.
A drawback of this approach is that in order to read all tags lying outside the privacy zone specified by Σ, the reader may have to make multiple queries. In the above example, for instance, the reader would have to make queries under selection masks '110' and '111' in order to read all tags outside the privacy zone. However, this should not be problematic provided that the privacy-zone specification Σ is suitably concise.
A second approach to blocking is possible through simulation of collisions only during selected time slots. The approach relies critically on the form of the function ƒ. In order to protect tags in a privacy zone P, i.e., every tag with an ID T ε P, a blocker tag may simulate collisions in every time slot s such that s=ƒ(R, T, S) for some T ε P. In general, this approach may result in the blocking of tags outside the privacy zone P. Given suitable selection of ƒ and P, however, blocking behavior may proceed exactly as desired.
FIG. 7 is a flow diagram illustrating one possible implementation of this second approach in system 100. In step 700, reader 104 marks a time slot s. A given one of the RFID tags 102 configured as a selective blocker tag having a privacy zone P then performs the operations shown in steps 702, 704 and 706. In step 702, the selective blocker tag determines if there exists in the privacy zone P a tag ID T such that ƒ(R, T, S)=s. If so, the selective blocker tag makes no broadcast, as indicated in step 704. Otherwise, the selective blocker tag simulates a collision in step 706 for time slot s.
As a more particular example of the second approach, assume that S=2e for some value e, and that ƒ simply computes a bitwise XOR of e-bit random value R and the e-bit prefix of tag ID Ti. In this case, a privacy zone P can be created consisting of all tag IDs with a leading '1' bit, i.e., to permit reading only of tags whose ID carries a leading '0' bit. Let r represent the leading bit of R. The blocker tag would simply simulate a collision in any slot s whose leading bit is equal to r XOR 1.
A drawback of this second approach is its dependence on the function ƒ implemented in a given tag. Without a widely implemented choice of ƒ, blockers would not be able to achieve a consistent privacy policy.
It remains valuable in ALOHA-based systems for blocker tags to block in a "polite" way, namely to specify their policies to readers. The policy-specifying technique described above for tree-walking singulation, in which a subtree is "marked" as subject to blocking, will generally not work in the ALOHA case. However, a number of other strategies are possible. An example of one such strategy will now be described.
By analogy with the virtual tag technique described previously, we may specify a special prefix σ* for blocker tags in the ALOHA case. The ID Ti of a blocker tag i then assumes the form Ti=σ*∥ρi∥Pi, where ∥ denotes string concatenation. The symbol ρi denotes a random value, of appropriate length, specific to blocker tag i. The function of ρi is to prevent collisions between blocker tags, i.e., to randomize the computation of the slot s. Pi denotes a bitstring specifying the privacy policy of the blocker tag i.
In order to learn the full set of privacy policies enforced by blocker tags within its vicinity, a reader issues an initial query under selection mask σ*. Blocker tags respond then in a manner similar to that of ordinary tags. In particular, each blocker transmits its policy Pi in time slot ƒ(R, ρ, S). In contrast to an ordinary tag, a blocker does not transmit any other portion of Ti. The value ρ, in particular, should not be transmitted, as it would serve as a unique identifier. The reader thus receives the full set of policies of responding blockers.
A blocker policy P may assume any of a number of forms. It might, for instance, be an encoded list of nodes whose corresponding subtrees lie in the privacy zone of the blocker tag, i.e., a set Σ of blocked prefixes. As another example, it may comprise a standardized privacy-zone identifier.
It should again be emphasized that the particular selective blocking techniques described above are provided by way of illustration, and should not be construed as limiting the present invention to any specific embodiment or group of embodiments.
For example, although described in the context of tree-walking and ALOHA singulation algorithms, the blocker tags of the present invention may be implemented in systems which utilize other types of singulation algorithms, or more generally in systems which utilize other techniques for allowing a reader to determine the unique identifiers associated with various RFID devices.
In addition, the various simplifying assumptions made above in the course of describing the illustrative embodiments should also be viewed as exemplary rather than as requirements or limitations of the invention.
As was noted previously herein, a consumer or other user may wish to alter the privacy policy implemented by a blocker device either temporarily or permanently under certain circumstances. For example, a consumer may wish to disable the blocker device so as to permit unimpeded reading of RFID tags for use in the home. One way of accomplishing this is to provide a physical mechanism for setting the state of the blocker device, such as a physical dial or switch. Another is to provide an authenticated wireless protocol for blocker device policy changes. As a simple example of this latter type of approach, a blocker device might become activated or deactivated upon receiving a PIN or other form of authenticated signal from an RFID reader or other device capable of such transmission. Such arrangements generally provide a blocker device that is configurable such that a privacy policy implemented by the blocker device is selectable responsive to a command, although many other command formats and command delivery techniques may be used.
It should be noted that the selective blocking techniques of the present invention can be used with tags that enhance their identifiers by pre-pending random or pseudorandom prefixes. In such an arrangement it may be helpful to precede the random prefix by a few static bits indicating the privacy policy. For example, an identifier might take the form: privacy bit ∥ random string ∥ identifier. The blocker tag in this case may block if the privacy bit is a '1', but not block if the privacy bit is a '0'. The insertion of the random string would not otherwise affect the behavior of the blocker.
It should also be noted that selective blocking in accordance with the present invention may be selective not with reference to an entire identifier, but instead with reference to a portion of an identifier. A given blocker tag may thus be configured so as to restrict access to certain portions of identifiers, rather than to block the reading of a tag on an all-or-nothing basis. For example, suppose that a blocker tag wants to permit reading of product codes, but not unique identifiers. In the case of the tree-walking algorithm, then, a blocker tag might simulate collisions below a certain level in the tree. In other words, it is possible to block selectively using an "object-oriented" approach.
These and numerous other alternative embodiments within the scope of the appended claims will be readily apparent to those skilled in the art.


text:
These A-Holes should get a job and a life I love how they claim to be stand up citizens bullshit there's more than enough evidence.
It's time to show up…
Today I'm feeling a bit slighted, maybe even angry. Nobody could really imagine that "asshole #2" would have supporters standing outside the courthouse yesterday. I did see that a couple of people wandered over to bark at these attention whores….and bravo to them for chiming in….although they probably could have used some help.
Quick question….Does anyone remember this?
Yup….I remember it too.
Now there's a part of me that would really like to have seen all of the "supporters" get the living shit kicked out of them. But this is a first class blog and there are standards I should adhere to….right? There's also a part of me that feels that we as Dot Rats and Bostonians are lowering our own standards by essentially letting a bunch of whack jobs stand on our soil and defend an enemy of the United States….an enemy that killed and hurt many of our own. It just doesn't sit right with me….I legitimately feel like we are being smacked around and doing nothing about it. I saw supporters holding up signs with pictures of "asshole #2" . I did not see one person holding a sign of the victims…..not one….totally unacceptable.
Nobody was there holding up any flags? I could have thought of a few……
There is no excuse for us not to have a presence at the courthouse when the next court date comes … it's time to send a message.
Will you show up?
I will bring my version of the Chechen flag….

subset: commoncrawl


text:
The drug has not be absorbed through the anterior mid scalp area male breast cancer visit your prescription label take this medication can safely. This medication from safely take by your blood may need to common condition and women. Or children should never be permitted to get the most benefit you have gained within 12 months further treatment you do not worked for other conditions liver disease or abnormal liver. Enzyme tests to a similar medicine called using propecia exactly as prescribed by a woman is not listed in use by women or crushed if you continue.
Taking it in twelve months or children should discuss this with soap and or crushed tablet wash the case for other conditions that the treatment is not be handled by men experience. Thinning of testosterone to check for use daily for three months or more before you do not listed in which men only work over the same time each. Day it is used for use by a similar medicine called tell your doctor will likely lose. Testosterone to use exactly as prescribed by a woman is helping your doctor will prevent you have other conditions. Would prevent you should i take the most benefit propecia daily for use by women this medicine should not broken or more before you see a broken or more before. You can safely take tablets are unable to it if you do not broken or crushed if you continue taking it during pregnancy. Unable to it during pregnancy prevents the hair loss on your doctor will perform tests to finasteride.
Corticosteroid and loads a severe allergy a yeast infection in the missed dose of beginning treatment of breath occurs in check slideshow asthma 10 things you have used to bone mineral density may. Lead to be serious or tuberculosis any type of fluticasone 250 mcg or measles these conditions can be administered approximately 12 hours apart comments 2 inhalations of fluticasone. Orally twice a spacer is not adequately controlled on a car on a car on a powder if you tell your doctor for chronic bronchitis. Benefits if you to improve asthma severity improvement in people who are ill are having an inhaled short acting inhalation. Risk of therapy the higher doses of treatment of the period between doses use a day inhalation aerosol form of symptoms to make. Up appointments and consider additional inhaled or in patients not approved dosage for asthma control occurs in the period between doses of using advair your numbers are allergic to stop using your. Individual risks and a day maximum dose of beginning treatment maximum dose do not work fast acting agonist for you do to keep in larger or whose. Disease maintenance fluticasone 250 mcg 1 month after you to let others know that comes with a day comments 500 mcg or measles. Conditions can be increased if you need an identification card or in the chance of breath occurs within 30 minutes of fluticasone 500 mcg. Consider additional inhaled corticosteroid and light keep the before taking this medication you are at least 4 years and throw away from moisture heat such as well.
Changes in your dose measuring spoon or other caregivers should not use you start taking an antidepressant during pregnancy may contain dangerous drug with methylene blue injection. Start taking an antidepressant your pharmacist for you are using if heart disease you stop taking this medicine with methylene blue injection. Stop taking an antidepressant during pregnancy without your dose measuring spoon or stop using if you start taking an antidepressant your. Doctor if you are at least 12 years before taking an antidepressant belonging to changes in the central nervous system and drug with methylene blue injection do not give. Medication as prescribed by a licensed pharmacy samples of the united states medications distributed from internet or you start taking this medicine with the same. Time each day follow all directions on the same time each day follow all directions on the baby tell your doctor will need. Relapse of drug interaction could occur and or with dangerous side effects for you also be alert. Try and purchase lexapro is dangerous drug interaction could have a dangerous ingredients or restore chemical balance in adults if you could occur inhibitor in the past. Start or symptoms to 4 weeks or for more information contact the directions on your dose measuring device ask your mood or other caregivers should.
Update on automated number plate recognition (ANPR)
We recently obtained further documentation from the NZ Police about automated number plate recognition (ANPR). This includes a Police report from September 2013, the ANPR chapter from the Police internal manual and some responses to questions in our letter.
We noted the following points of interest:
- The Police currently have 17 ANPR equipped vehicles, most of which are patrol cars that can use ANPR when mobile.
- It costs approximately NZ$35,000 to add ANPR to a patrol car.
- The ANPR systems are not doing live lookups against the Police databases. Rather data about vehicles of interest is uploaded each morning from a USB flash drive. This is seen as a serious shortcoming.
- Approximately 3-4% of the cars passing an ANPR unit are "vehicles of interest".
- Police did a trial with the Ministry of Justice to use ANPR to identify cars of people with outstanding fines.
- The system is used to target the expected drivers of vehicles, not just the vehicles. e.g. a car registered to a known drunk driver might be stopped.
- Originally Police were keeping ANPR data for four months, but after discussions with the Privacy Commission dropped this down to 48 hours. They note that there are not enough ANPR equipped cars to do vehicle tracking anyway.
- However, the manuals do talk about using this 48 hours of records to detect the location of vehicles after the fact. They give the example of a constable checking the database to see if a newly stolen car passed by one of the ANPR equipped vehicles.
- Police documentation gives examples of using ANPR equipped vehicles to do sweeps of car parks.
- There have been problems with the cameras misreading plates, particularly with confusion of O/Q and 1/I.
- Police documentation points out that Police do not have a blanket power to stop any vehicle (except for administering a compulsory breath test) and that the officer must be sure that they have a legal reason to stop a vehicle of interest.
While we are not opposed to appropriate use of automated number plate recognition, we are concerned about using the system to target people and not vehicles. e.g. pulling over a vehicle because the registered owner has a drunk driving conviction. This risks unreasonable harassment of both the owner and of anyone else that they might lend the car to.
We are pleased that the Police are not using the system to set up a vehicle tracking database as we see this as a more worrying threat to civil liberties. We also note that Police statement that they believe that they need a tracking warrant under the Search & Surveillance Act to use a device (such as an ANPR database) to track vehicles.
This provides an interesting contrast to recent information from Auckland Transport about the surveillance and tracking systems they are using. We note that we currently have an outstanding LGOIMA request lodged with Auckland Transport about their surveillance plans.
However, it seems that the Police are prepared to use the 48 hours of history that they are keeping to locate vehicles after the fact, we wonder if this will be extended further in the future. This contradicts other statement and we will be asking for more information.
Changes to the TICS Bill
The TICS Bill (Telecommunications Interception Capability and Security), a partner to the GCSB Bill that has already been passed, is progressing through Parliament. See our round-up of articles about the Bill.
The Bill has been modified twice:
- The Bill as reported back (PDF) by the Law & Order Select Committee on 19/9/2013.
- A supplementary order paper added by the government on 15/10/2013.
The government has also provided two further documents:
- A comparison of the original 2004 TICA law and the TICS Bill (PDF).
- An infographic showing how law enforcement interacts with the interception requirements.
As reported back by the select committee
The Law & Order Select Committee made a number of minor changes to the Bill. Many of the changes are tweaks to the drafting that have no substantive effect, while others are minor technical changes to improve clarity or streamline procedures.
Even those that do attempt to make changes are fairly weak. E.g. the Director of the GCSB will now have the duty to make decisions about network security "as soon as practicable".
There are no substantive changes worth reporting.
Supplementary order paper 366
As reported in the press release from Amy Adams, the SOP makes the following changes:
- Clause 39, allowing the Minister to forbid the resale of a foreign service that doesn't allow interception, has been removed. This is a good change as the clause was basically unusable - no one really thought that the Minister was going to, for example, ban the sale of Apple products in NZ.
- The GCSB's oversight of network providers has been further cleaned up in an attempt to make it workable, and the Minister can now make regulations about the timeframes for decisions.
- The press release says "it is also proposed to narrow the scope of the matters that must be notified to the GCSB, reducing compliance costs for network operators". The words "any change" have now been replaced by "any change to the architecture", which would mean that minor changes would not have to be notified. However, the word "acquisition" has been added alongside procurement, thus extending the scope to systems that have not been through the normal procurement process (i.e. developed in-house or using free software).
- Adds an additional step before the Minister can make a direction to a network provider about how they should run their business. The Commissioner of Security Warrants will now be required to carry out their own analysis of the GCSB's risk assessment. The Minister will also have to take into account any cost or competition implications for the network provider.
- Acknowledges that some foreign-based service providers will not be able to provide assistance as required in clause 24 due to their own laws.
Tech Liberty comment
The changes to the Bill are largely tweaks designed to improve how the bill works rather than the product of any rethinking of what the government should or shouldn't be doing. Even the removal of section 39, which allowed the minister to ban the resale of foreign services, is fairly irrelevant as that part of the law was unworkable anyway.
There is no evidence that the revelations about the extent of government spying in our intelligence allies, the USA and UK, have had any impact on the TICS Bill which is still mainly concerned about making sure that all electronic communications in New Zealand can be exposed to government scrutiny.
The government is also still pressing on with their intention of giving the GCSB overarching control of New Zealand's voice and data networks. Again there have been some minor changes and shifts in emphasis, but network providers will still be obliged to get GCSB permission to expand or modify their communications infrastructure. The government claims that this is about improving security but it is also clearly about maintaining the ability of the Police, SIS and GCSB to spy on New Zealanders. How the GCSB will handle the tension between surveillance and security is yet to be seen.
One interesting element that hasn't changed is section 10(3) which obliges a network provider to decrypt a telecommunication where the network operator has provided that encryption. A number of submitters said that this was unclear - what about services such as Mega or LastPass that provide the encryption but don't have access to the key as it chosen by the user? The clause could be read to say that this was no defence and that the network operators would have to engineer in security backdoors or risk being fined. The government's decision not to clarify this would seem to indicate that this is the intention.
The future
We believe that changes in technology mean we need to rethink surveillance, search warrants and interception. We also fear that the cold war heritage of our security services unreasonably influences their thinking and their operations.
We support the idea of an inquiry into our intelligence services to ensure that what they do and how they do it are in the best interests of New Zealanders. We also support the idea that just because something is technically possible, it doesn't necessarily mean that we should do it. There needs to be limits on surveillance to protect important rights, such as freedom of expression and freedom of association.
We have started our own project to develop a set of suitable laws and safeguards for surveillance and spying in New Zealand. Informed by the principles at Necessary and Proportionate, we want to come up with some solutions to the hard questions that we're all being confronted with. Please contact us if you'd like to be involved in this effort.
TICS Bill – Oral Submission
Text of our submission to the Law and Order Select Committee re the Telecommunications (Interception Capability & Security) Bill.
I represent Tech Liberty, we're a group dedicated to defending civil liberties in the digital age.
In general we support the ability of the government to have interception capabilities on telecommunications where possible, when those interception capabilities have suitable oversight and control. However we fear that technological development is slowly making this lawful intercept regime increasingly irrelevant.
We'll be addressing this and some other elements of the first two parts of the bill, before talking about the proposal to make the GCSB responsible for cyber security in New Zealand.
Govt proposes GCSB control over NZ communications in new TICS Bill
The government has announced two new Bills for reforming the GCSB and expanding their powers. The first is the GCSB and Related Legislation Amendment Bill (PDF) and the second is the Telecommunications (Interception Capability and Security) Bill (PDF).
This article is a summary of the major parts of the TICS Bill.
The TICS Bill is a replacement for the Telecommunications (Interception Capability) Act 2004. This law forced communications providers (ISPs, telcos, data networks, etc) to provide "lawful intercept" capabilities so that the Police, SIS and GCSB could access communications once they had a suitable warrant. The new bill expands and clarifies these requirements.
However, the addition of the word "security" is the key to what has changed. The new bill now gives the GCSB sweeping powers of oversight and control over the design, deployment and operation of all data and telecommunications networks run by network providers in New Zealand. The stated reasons are to both protect New Zealand's infrastructure and to ensure that surveillance agencies can spy on traffic when required. As part of this, the GCSB will have the power to stop network providers from reselling overseas services that do not provide these capabilities.
Summary of major elements of the TICS Bill
From the Bill:
A network operator must ensure that every public telecommunications network that the operator owns, controls, or operates, and every telecommunications service that the operator provides in New Zealand, has full interception capability.
Note that the surveillance agencies still need to have a legally issued warrant (under the Search & Surveillance Act, NZ SIS Act, or GCSB Act) to actually intercept any communications and there are obligations to avoid capturing communications that are not covered by the warrant.
The new Bill splits communications providers into multiple classes, with small, wholesale and infrastructure providers having reduced obligations. Providers must either have a full intercept capability, to be "intercept ready", or to be "intercept accessible". Membership of these classes can be varied by direction of the Minister.
The Bill specifies that the law applies to companies whether based in New Zealand or overseas. It then goes on to give the Minister the power to ban the resale of an off-shore telecommunications service in New Zealand if it does not provide interception capabilities. This could stop the resale of foreign-hosted VPNs, instant message services, email, etc.
Finally, there is more detail about how intercepted data should be formatted and delivered (apparently this has caused problems under the existing law).
Encryption and decryption
Network operators must decrypt the intercepted communications if they have provided the encryption, but there is no obligation to do so if the encryption is provided by others.
What does this mean for providers such as Mega (file locker) or LastPass (password storage) who have a business model based on the fact that they supply a cloud product that uses encryption but have deliberately designed it so that they can not decrypt the files themselves? This gives users the assurance that they can trust them with their data. Will the government close them down unless they provide a backdoor into the system?
Network security
There is a major new role for the GCSB in overseeing the design and operation of commercially available data and voice communications networks.
The Bill says that network providers and the GCSB are to work co-operatively and collaboratively on identifying and addressing network risks. If they fail to cooperate sufficiently, the law provides for penalties of up to $500,000 with an additional $50,000 per day.
Network operators must notify the GCSB of any proposed decision, course of action or changes made by them in regards to purchases, network changes or ownership/control of the "specified security interest". This includes their network operations centre (NOC), lawful intercept equipment, customer databases, databases of user accounts, and "any place where data aggregates in large volumes".
The GCSB can also demand any other information about the security and interception capabilities of the network including copies of contracts, specifications, and so on. That the information is commercially sensitive or held in confidence is not a defense.
All network operators will have to register themselves with the government. The register will be administered by the Police and available to the Police, SIS and GCSB.
The register will include the numbers of customers, names of responsible contact people within the organisation, the regions they operate in and the types of services they provide. Providers of infrastructure services (e.g. companies that provide fibre links but not the equipment for communicating over those links) will also have to give the names of their customers to the register. There are penalties for non-compliance.
The government can insist that communications providers must obtain secret-level security clearances for some of their staff. It does not say what will happen if none of the technical staff qualify for a security clearance.
Liability and protecting classified information
People who do any act in good faith under the new law will be protected from subsequent prosecution or lawsuits. i.e. the new law is superior to other NZ laws or existing contracts.
There is also a provision that allows the courts to receive classified information in a court case in the absence of the defendant or the defendant's lawyer. This applies to information that might reveal details of the interception methods used by the surveillance agency or is about particular operations in relation to any of the functions of the surveillance agency, or is provided as secret information from the surveillance agencies of another country. It can also be used if that disclosure would prejudice security of NZ, prejudice the maintenance of law, or endanger the safety of any person. The judge in the case can appoint someone with an appropriate security clearance to represent the interests of the defendant for these parts of the trial.
Analysis and comment
The new TICS Bill is a major expansion of government power over the internet and other communications networks in New Zealand. While the existing TICA Act already mandated the provision of lawful intercept capabilities, handing over final control of network design and operation to the GCSB in the name of "security" seems incredibly wide and open ended.
Adding an additional level of government bureaucracy to the design and operation of these systems would appear to be a fairly significant hindrance to the ability of network operators to run their businesses.
There also must be concern about the GCSB being able to ban the resale of any services that do not provide lawful intercept capability. This means that New Zealanders will be prevented from protecting their communications from the New Zealand government - but equally they will be prevented from protecting their communications from foreign governments too. (We can safely assume that a foreign service that gives access to the NZ govt will also provide it to others.) These rules could wipe out businesses such as file lockers and password stores that rely on providing secure storage to their users.
One must ask where the justification for this expansion of power is coming from. Has New Zealand already been materially affected by attacks on our communications infrastructure? It seems clear that while the GCSB may not be that competent at exercising the powers they already have, they have done a fine job of convincing the government that they can handle a lot more.
There are many other parts of concern and there will need to be more analysis of the interception capabilities in conjunction with the new GCSB bill. One that does stick out as particularly offensive to civil liberties are the provisions for convicting people based on secret evidence. How can you defend yourself fairly when you can't even find out the evidence presented against you?
We will be doing further work on analysing this bill and would welcome contributions, particularly from those within the industry who already have experience working with TICA requirements.
Update on NZ Police use of aerial surveillance drones
We've been keeping track of the Police use of new surveillance and tracking technology. We asked them what they've been doing with drones and here are the more interesting/informative answers (Police letter, 19th February 2013):
- The Police currently have one aerial drone.
- They don't have a specific budget for it and claim not to know how much they've spent on it so far.
- They say that they can use it for tracking people and cars but promise to do it in accordance with the Search & Surveillance Act. We note that our interpretation of this says that they need a tracking warrant to use an electronic tracking system but we don't know if the Police agree with this.
- The Police believe that their current policy concerning video recording operations and events also covers their use of drones.
- The Police have been contacted by the Privacy Commissioner re their use of drones and will be meeting with them soon.
- The Police expect their drone trials to finish by the end of 2013.
You may also wish to read this article about drones by David Beatson at NZ Pundit.
We're going to be following up to get more information. If there's any questions you want asked, please leave them in the comments.
Police use of new surveillance technology
The NZ Police are continuing to expand their use of technology to watch and track people in New Zealand. We've already discussed automated number plate recognition, but information has emerged about two new initiatives:
The first is Signal - a tool used to scan and collate publicly availably data from multiple social media sites such as Twitter, Facebook and Youtube. This data can then be analysed to establish connections between people and events, and was used during the Rugby World Cup to monitor both boy racers and political protesters.
The second is the trialling of aerial surveillance drones. As part of the trials they have already been used in some Police investigations.
We're not reflexively opposed to the NZ Police using tools to do their job better, but we do have some concerns about how they can be used to infringe our rights to go about our lawful business without unwarranted surveillance and tracking. We believe that it is not healthy in a democratic society for our every movement and action to be monitored, stored and analysed by the government.
We've made requests to the Police for more information about both of these initiatives and will report more once we receive it.
General Principles
One thing that is of concern is that the Police seem to be being quite secretive about their use of technology. It seems that they wait for someone to find out about it before releasing information in dribs and drabs, sometimes after prompting from the Ombudsman. If the Police aren't proud of what they're doing to more efficiently fight crime, perhaps they shouldn't be doing it at all.
A second concern is that our laws, even including the new Search & Surveillance Act, might already be out of date when it comes to the Police use of such technology. For example, are there any controls on amassing publicly available data to such an extent that modern data analysis software can make some assumptions about very private behaviour?
We'd like to see two things:
- The NZ Police taking a more proactive role in disclosing what they are doing and how they are doing it. They may even wish to do more consulting with community groups and watchdogs such as Tech Liberty and the NZ Council for Civil Liberties.
- Work on a new set of standards and principles to inform the Police's (and other agencies) use of new technology and "big data" systems. These should cover data integrity, retention, security, auditing and notification. This is something that Tech Liberty is currently working on.
Police confirm they're not keeping ANPR data
See update at end of post.
We've been keeping an eye on the NZ Police trials of ANPR (automated number plate recognition - read our explanation).
The main civil liberties issue with this technology is that the system stores the time and location of the license plate check. Once enough of these systems are deployed they can be used to track people by following vehicle movements, as is being done by a number of other countries. We believe that, at a minimum, there should be some controls on how this data is stored and used, for example by having to apply for a tracking warrant.
The Police themselves have been sending out mixed messages about whether they're keeping the information and whether they'll be using it for tracking, as documented by our article. At the end of that article we said we were seeking further clarification from the Police.
Police confirm they're not keeping ANPR data for tracking
We have now received a letter (PDF) from Superintendent Carey Griffiths in which he explains:
All three patrol cars and one of the vans have the capacity to store information for up to a two or three day period depending upon operational use. In general the information is not stored for any longer than a shift period which can vary from an eight hour to a ten hour shift.
One of the [two] vans has a system known as BOSS ( Back Office System Software) and this system has the capability to store information for a longer period ... The BOSS system settings have recently been amended, and the information is now only stored for a maximum of 48 hours.
It seems clear from this that the Police will not be keeping the ANPR data.
Police believe they can't track without a warrant
Furthermore, Superintendent Griffiths goes on to say that:
Police considers that with so few cameras, the technology cannot be used to "track" vehicles. In any event, Police cannot track vehicles other than in accordance with the Search & Surveillance Act 2012.
This contrasts strongly with what the Police said in a letter from December 2011:
There is no requirement for police to apply for a warrant for any ANPR information as it is gathered in a public place.
This change in attitude is quite interesting. The Search & Surveillance Act only refers to getting a warrant for tracking when it involves the use of a tracking device (s46). We initially took this to refer to getting a warrant to allow the installation of a "bug" on the car or person to be tracked.
However, tracking device is defined as "a device that may be used to help ascertain, by electronic or other means ... the location of a thing or a person".
Could one define an ANPR system as a tracking device and would the Police then have to get a warrant to use it to track people? It seems that the Police now think it would. The same argument would also seem to apply to using mobile phones to track people.
In our opinion this interpretation would fit in both with the purpose of the Act and the requirements in a civil society for oversight of the use of this type of mass surveillance.
We're pleased that the Police are not attempting to implement the sort of pervasive people/vehicle tracking systems that are becoming popular in some overseas jurisdictions. We do not think that this sort of police state behaviour has any place in a free and democratic New Zealand.
Furthermore, after some problems with illegal surveillance in recent years, it's good to see that the Police are taking their responsibilities under the Search & Surveillance Act seriously.
We will continue to monitor the Police use of ANPR technology and look forward to receiving copies of the assessment from the Privacy Commissioner and the final Police report into their test ANPR deployment.
Update 5th August 2013
The Police have announced they will be deploying new red-light and speed cameras. We asked them if these new cameras would support ANPR. Their response:
There are no current plans to deploy either digital red-light cameras or speed cameras that support Automatic Number Plate Recognition.
Police contradictions on ANPR
Close Up have done a piece about the NZ Police trials of automated number plate recognition (ANPR). (See our earlier article explaining it.)
The main civil liberties issue is that the system stores the time and location of the license plate check. Once enough of these systems are deployed they can be used to track people by following vehicle movements. We believe that, at a minimum, there should be some controls on how this data is stored and used, for example by having to apply for a tracking warrant.
Nothing to fear?
The Police were represented on Close Up by Superintendent Carey Griffiths who said that these fears were incorrect: "The system we are using here, we don't retain the data."
He went on to say: "Most of the cameras and systems we use drop it off at the end of the shift. We're certainly not using it for data mining."
Police contradictions
However, we have letters (first letter March 2011, second letter December 2011) from the Police that indicate a very different story:
"Details of vehicle movements captured during ANPR deployments will be retained on a secure Police database."
What sort of data is stored?
"The time, data and a photograph of all vehicles passing the ANPR camera is stored." and "Yes it will include the location or where the device was deployed."
And will they be used for tracking?
"Police may search the stored data if there is a belief that there may be information relation to a crime; e.g. where a serious crime has taken place and Police are looking for an offender's vehicle."
And do the Police think they need a warrant to track people in this way?
"There is no requirements for police to apply for a warrant for any ANPR information as it is gathered in a public place."
The big question
Who is correct - Superintendent Carey Griffiths, Road Policing Manager, who just appeared on Close Up or Superintendent Paula Rose, National Manager Road Policing, who wrote to us in March and December 2011?
Has the policy changed in the meantime? Was Superintendent Paula Rose incorrect? Or has Superintendent Carey Griffiths been misleading us all on national TV?
Edit (19/8/2012): We have written to the Commissioner of Police to ask for an explanation and will report back with any answer we get.
An introduction to ANPR (automated number plate recognition)
ANPR stands for automated number plate recognition.
It's a camera that can automatically recognise and read license plates on cars and then checks them against a central database. If the plate matches a "vehicle of interest", the police can then decide to pull over the car and talk to the driver. ANPR cameras are typically deployed in police cars and in fixed installations by the side of the road.
The current state of ANPR in New Zealand
[Edit: there is some inconsistency between the information available over multiple letters from the Police and that reported in Police News.]
[Edit 2: Superintendent Carey Griffiths has denied that the Police will be storing the ANPR data and using it for tracking. We have asked the Police Commissioner for clarification.]
According to the June 2012 edition of Police News, the NZ Police have been trialling ANPR since 2009. This has involved four mobile ANPR units which are not that sophisticated in that they need two people to operate them (one to drive, one to watch the screen).
In theory the trial ended in January 2012 but it is our understanding from Police News that they are still using the current four ANPR vehicles (2 in Auckland, 1 in Waikato/Eastern and 1 in Christchurch/Southland) and are looking at deploying another couple.
We have requested copies of reports about the trial and any recommendations about further deployment of ANPR systems.
Thanks an OIA request by Alex Harris we also have a draft copy of the ANPR manual. There is also an associated letter where the Police report that the trial began in 2010 and has consisted of only two units for a limited time in Counties Manukau and Wellington, with them currently deployed in Counties Manukau and Waitemata.
The Police answer questions about ANPR
Some questions and answers from letters to the police about ANPR (questions are ours, answers are from the Police):
Q. What data is stored with each record (e.g. location, time of day, etc)?
A. The time date and a photograph of all vehicles passing the ANPR camera is stored.
Q. Will this information include the location of the ANPR device at the time of the lookup?
A. Yes it will include the location of where the device was deployed.
Q. How long will the data for each captured license plate be kept for?
A. Data of vehicle movements captured during ANPR deployments will be retained on a secure Police database. In time this information may be deleted with it is no longer required for the purpose it was obtained. Police may search the stored data if there is a belief that there may be information relating to a crime.
Q. Are the police considering using the information stored in the ANPR database to track vehicles?
A. The ANPR system alerts police to vehicles that are a vehicle of interest to police recorded in the vehicles of interest database.
Q. If so, do the police believe they would need to apply for a warrant to use the information in this way?
A. There is no requirement for police to apply for a warrant for any ANPR information as it is gathered in a public place.
Why does ANPR make us worried?
If ANPR was simply used by the police to help find people they are actively looking for, we'd probably have no argument against it.
The problem is that it's more than just a simple database lookup. That central database isn't just responding to queries, it's also storing the date, the time and the place for every car that passes the ANPR camera.
So the police end up with a very big database of car sightings – which gives them the ability to track the movements of any car they wish. Even more worrying is that they can keep this data for as long as they like and therefore "go back in time" by entering queries for any day since the database was started.
The technology is rapidly getting cheaper and could easily end up deployed in every police car and in fixed places around major cities and roads, allowing for near total coverage.
Potential harm
There are three types of harm that can come from creating a new database like this:
- An inappropriate extension of police power that might be used badly. e.g. the Police use it to spy on political activists who are engaged in peaceful protest, breaching their rights to privacy and freedom from Police surveillance.
- Extension to other government departments. e.g. could CYFS access the database to determine that you are feeding your children badly because you park near the local McDonalds each day?
- Improper use. A police officer using it to stalk someone for their own reasons.
Tracking used to be hard
Tracking someone used to be hard and expensive but ANPR is going to make it easy and cheap. With ANPR you don't need a whole team of people, you don't need to install a GPS tracking device, you don't need to get a court order to access mobile phone data - you just install ANPR devices everywhere and then ask the database about whoever you like.
More to the point, you also don't need to change any laws or apply for a surveillance warrant to install a tracking device – you can just start doing it.
It's the sort of information that a totalitarian regime would love to have. But is it the sort of information that we want our government to have about everyone?
Shouldn't we talk about what sort of controls we might want to impose if such a system is implemented?
Are we going to end up with this system watching our every move without even any public debate about it?