{"id":4008,"date":"2009-07-30T10:38:20","date_gmt":"2009-07-30T01:38:20","guid":{"rendered":"http:\/\/www.debito.org\/?p=4008"},"modified":"2009-07-30T11:57:40","modified_gmt":"2009-07-30T02:57:40","slug":"update-putting-the-pieces-together-upcoming-ic-gaijin-cards-rfid-hackability-next-generation-police-walkie-talkie-and-npa-access-to-taspo-information","status":"publish","type":"post","link":"https:\/\/www.debito.org\/?p=4008","title":{"rendered":"Update putting the pieces together: upcoming IC Gaijin Cards, RFID hackability, next generation police walkie-talkie, and NPA access to TASPO information"},"content":{"rendered":"

\"Handbook<\/a>\"\\\"<\/a>\"Foreign<\/a>\"\\\"<\/a>\"\u300c\u30b8\u30e3\u30d1\u30cb\u30fc\u30ba\u30fb\u30aa\u30f3\u30ea\u30fc\u3000\u5c0f\u6a3d\u5165\u6d74\u62d2\u5426\u554f\u984c\u3068\u4eba\u7a2e\u5dee\u5225\u300d\uff08\u660e\u77f3\u66f8\u5e97\uff09\"<\/a>\"JAPANESE<\/a>\"sourstrawberriesavatar\"<\/a>UPDATES ON TWITTER: arudoudebito<\/p>\n

Hi Blog. Last May I put out an article in the Japan Times about the (now approved) IC Chips in revamped Gaijin Cards.<\/a> How they would enable the police forces to remotely track foreigners in a crowd, and how data would be less secure from hackers.<\/p>\n

Not unsurprisingly, I was told I was exaggerating. But it’s hard in this day to exaggerate the reach and rate of development of technological advances (who would have thought we would have this very medium to communicate through a little over ten years ago?). So here are some sources showing how 1) ID Chips and RFID technology is eminently hackable and remotely trackable, 2) how police already have IC scanning ability in their walkie-talkies, and 3) how the Japanese police in particular are using ID cards beyond their originally-intended purpose to track crime. I don’t think I was exaggerating at all. Arudou Debito in Sapporo<\/p>\n

==============================================<\/p>\n

Chips in official IDs raise privacy fears (excerpt)
\nBy TODD LEWAN
\nAssociated Press
\nPosted on San Jose Mercury News: 07\/11\/2009 09:37:12 AM PDT, courtesy TJL.<\/strong>
\nComplete article at http:\/\/www.mercurynews.com\/breakingnews\/ci_12816946
\n<\/a><\/p>\n

Climbing into his Volvo, outfitted with a Matrics antenna and a Motorola reader he’d bought on eBay for $190, Chris Paget cruised the streets of San Francisco with this objective: To read the identity cards of strangers, wirelessly, without ever leaving his car.<\/p>\n

It took him 20 minutes to strike hacker’s gold.<\/p>\n

Zipping past Fisherman’s Wharf, his scanner detected, then downloaded to his laptop, the unique serial numbers of two pedestrians’ electronic U.S. passport cards embedded with radio frequency identification, or RFID, tags. Within an hour, he’d “skimmed” the identifiers of four more of the new, microchipped PASS cards from a distance of 20 feet.<\/p>\n

Embedding identity documents \u2014 passports, drivers licenses, and the like \u2014 with RFID chips is a no-brainer to government officials. Increasingly, they are promoting it as a 21st century application of technology that will help speed border crossings, safeguard credentials against counterfeiters, and keep terrorists from sneaking into the country.<\/p>\n

But Paget’s February experiment demonstrated something privacy advocates had feared for years: That RFID, coupled with other technologies, could make people trackable without their knowledge or consent.<\/p>\n

He filmed his drive-by heist, and soon his video went viral on the Web, intensifying a debate over a push by government, federal and state, to put tracking technologies in identity documents and over their potential toerode privacy.<\/p>\n

Putting a traceable RFID in every pocket has the potential to make everybody a blip on someone’s radar screen, critics say, and to redefine Orwellian government snooping for the digital age.
\n(snip)<\/p>\n

Mark Roberti, editor of RFID Journal, an industry newsletter, recently acknowledged that as the use of RFID in official documents grows, the potential for abuse increases.<\/p>\n

“A government could do this, for instance, to track opponents,” he wrote in an opinion piece discussing Paget’s cloning experiment. “To date, this type of abuse has not occurred, but it could if governments fail to take privacy issues seriously.”<\/p>\n

\u2014\u2014\u2014
\nImagine this: Sensors triggered by radio waves instructing cameras to zero in on people carrying RFID, unblinkingly tracking their movements.<\/p>\n

Unbelievable? Intrusive? Outrageous?<\/p>\n

Actually, it happens every day and makes people smile \u2014 at the Alton Towers amusement park in Britain, which videotapes visitors who agree to wear RFID bracelets as they move about the facility, then sells the footage as a keepsake.<\/p>\n

This application shows how the technology can be used effortlessly \u2014 and benignly. But critics, noting it can also be abused, say federal authorities in the United States didn’t do enough from the start to address that risk.<\/p>\n

The first U.S. identity document to be embedded with RFID was the “e-passport.”<\/p>\n

In the wake of the Sept. 11 attacks \u2014 and the finding that some of the terrorists entered the United States using phony passports \u2014 the State Department proposed mandating that Americans and foreign visitors carry “enhanced” passport booklets, with microchips embedded in the covers.<\/p>\n

The chips, it announced, would store the holder’s information from the data page, a biometric version of the bearer’s photo, and receive special coding to prevent data from being altered.<\/p>\n

In February 2005, when the State Department asked for public comment, it got an outcry: Of the 2,335 comments received, 98.5 percent were negative, with 86 percent expressing security or privacy concerns, the department reported in an October 2005 notice in the Federal Register.<\/p>\n

“Identity theft was of grave concern,” it stated, adding that “others expressed fears that the U.S. Government or other governments would use the chip to track and censor, intimidate or otherwise control or harm them.”<\/p>\n

It also noted that many Americans expressed worries “that the information could be read at distances in excess of 10 feet.”<\/p>\n

Those concerned citizens, it turns out, had cause.<\/p>\n

According to department records obtained by researchers at the University of California, Berkeley, under a Freedom of Information Act request and reviewed by the AP, discussion about security concerns with the e-passport occurred as early as January 2003 but tests weren’t ordered until the department began receiving public criticism two years later.<\/p>\n

When the AP asked when testing was initiated, the State Department said only that “a battery of durability and electromagnetic tests were performed” by the National Institute of Standards and Technology, along with tests “to measure the ability of data on electronic passports to be surreptitiously skimmed or for communications with the chip reader to be eavesdropped,” testing which “led to additional privacy controls being placed on U.S. electronic passports … ”<\/p>\n

Indeed, in 2005, the department incorporated metallic fibers into the e-passport’s front cover, since metal can reduce the range at which RFID can be read. Personal information in the chips was encrypted and a cryptographic “key” added, which required inspectors to optically scan the e-passport first for the chip to communicate wirelessly.<\/p>\n

The department also announced it would test e-passports with select employees, before giving them to the public. “We wouldn’t be issuing the passports to ourselves if we didn’t think they’re secure,” said Frank Moss, deputy assistant Secretary of State for passport services, in a CNN interview.<\/p>\n

But what of Americans’ concerns about the e-passport’s read range?<\/p>\n

In its October 2005 Federal Register notice, the State Department reassured Americans that the e-passport’s chip \u2014 the ISO 14443 tag \u2014 would emit radio waves only within a 4-inch radius, making it tougher to hack.<\/p>\n

Technologists in Israel and England, however, soon found otherwise. In May 2006, at the University of Tel Aviv, researchers cobbled together $110 worth of parts from hobbyists kits and directly skimmed an encrypted tag from several feet away. At the University of Cambridge, a student showed that a transmission between an e-passport and a legitimate reader could be intercepted from 160 feet.<\/p>\n

The State Department, according to its own records obtained under FOIA, was aware of the problem months before its Federal Register notice and more than a year before the e-passport was rolled out in August 2006.<\/p>\n

“Do not claim that these chips can only be read at a distance of 10 cm (4 inches),” Moss wrote in an April 22, 2005, e-mail to Randy Vanderhoof, executive director of the Smart Card Alliance. “That really has been proven to be wrong.”<\/p>\n

The chips could be skimmed from a yard away, he added \u2014 all a hacker would need to read e-passport numbers, say, in an elevator or on a subway.<\/p>\n

Other red flags went up. In February 2006, an encrypted Dutch e-passport was hacked on national television, with researchers gaining access to the document’s digital photograph, fingerprint and personal data. Then British e-passports were hacked using a $500 reader and software written in less than 48 hours.<\/p>\n

The State Department countered by saying European e-passports weren’t as safe as their American counterparts because they lacked the cryptographic key and the anti-skimming cover.<\/p>\n

But recent studies have shown that more powerful readers can penetrate even the metal sheathing in the U.S. e-passport’s cover.<\/p>\n

John Brennan, a senior policy adviser at the State Department’s Bureau of Consular Affairs, concedes it may be possible for a reader to overpower the e-passport’s protective shield from a distance.<\/p>\n

However, he adds, “you could not do this in any large-scale, concerted fashion without putting a bunch of infrastructure in place to make it happen. The practical vulnerabilities may be far less than some of the theoretical scenarios that people have put out there.”<\/p>\n

That thinking is flawed, says Lee Tien, a senior attorney and surveillance expert with the Electronic Frontier Foundation, which opposes RFID in identity documents.<\/p>\n

It won’t take a massive government project to build reader networks around the country, he says: They will grow organically, for commercial purposes, from convention centers to shopping malls, sports stadiums to college campuses. Federal agencies and law enforcement wouldn’t have to control those networks; they already buy information about individuals from commercial data brokers.<\/p>\n

“And remember,” Tien adds, “technology always gets better … ”<\/p>\n

\u2014\u2014\u2014
\nWith questions swirling around the e-passport’s security, why then did the government roll out more RFID-tagged documents \u2014 the PASS card and enhanced driver’s license, which provide less protection against hackers?<\/p>\n

The RFIDs in enhanced driver’s licenses and PASS cards are nearly as slim as paper. Each contains a silicon computer chip attached to a wire antenna, which transmits a unique identifier via radio waves when “awakened” by an electromagnetic reader.<\/p>\n

The technology they use is designed to track products through the supply chain. These chips, known as EPCglobal Gen 2, have no encryption, and minimal data protection features. They are intended to release their data to any inquiring Gen 2 reader within a 30-foot radius.<\/p>\n

This might be appropriate when a supplier is tracking a shipment of toilet paper or dog food; but when personal information is at stake, privacy advocates ask: Is long-range readability truly desirable?<\/p>\n

The departments of State and Homeland Security say remotely readable ID cards transmit only RFID numbers that correspond to records stored in government databases, which they say are secure. Even if a hacker were to copy an RFID number onto a blank tag and place it into a counterfeit ID, they say, the forger’s face still wouldn’t match the true cardholder’s photo in the database, rendering it useless.<\/p>\n

Still, computer experts such as Schneier say government databases can be hacked. Others worry about a day when hackers might deploy readers at “chokepoints,” such as checkout lines, skim RFID numbers from people’s driver’s licenses, then pair those numbers to personal data skimmed from chipped credit cards (though credit cards are harder to skim). They imagine stalkers using skimmed RFID numbers to track their targets’ comings and goings. They fear government agents will compile chip numbers at peace rallies, mosques or gun shows, simply by strolling through a crowd with a reader.<\/p>\n

Others worry more about the linking of chips with other identification methods, including biometric technologies, such as facial recognition.<\/p>\n

The International Civil Aviation Organization, the U.N. agency that sets global standards for passports, now calls for facial recognition in all scannable e-passports.<\/p>\n

Should biometric technologies be coupled with RFID, “governments will have, for the first time in history, the means to identify, monitor and track citizens anywhere in the world in real time,” says Mark Lerner, spokesman for the Constitutional Alliance, a network of nonprofit groups, lawmakers and citizens opposed to remotely readable identity and travel documents.
\nImplausible?<\/p>\n

For now, perhaps. Radio tags in EDLs and passport cards can’t be scanned miles away.<\/p>\n

But scientists are working on technologies that might enable a satellite or a cell tower to scan a chip’s contents. Critics also note advances in the sharpness of closed-circuit cameras, and point out they’re increasingly ubiquitous. And more fingerprints, iris scans and digitized facial images are being stored in government databases. The FBI has announced plans to assemble the world’s largest biometric database, nicknamed “Next Generation Identification.”<\/p>\n

“RFID’s role is to make the collection and transmission of people’s biometric data quick, easy and nonintrusive,” says Lerner. “Think of it as the thread that ties together the surveillance package.”<\/strong><\/em>
\nENDS
\n===================================<\/p>\n

THE NEXT GENERATION OF POLICE WALKIE TALKIES<\/strong>
\nCourtesy of Ben<\/p>\n

Police Service Terminal JT6810-C series<\/strong> (excerpt)
\nhttp:\/\/www.alibaba.com\/product-gs\/204379280\/Police_Service_Terminal_JT6810_C_series.html<\/a>
\nBasic functions:<\/strong>
\n1 PDA palmtop computer
\n2 Number pad
\n3 EDGE 2.75G wireless communication
\n4 Global Position System(GPS)
\n5 Geographic Information System(GIS)
\n6 800 M digital mobile radio line
\n7 IC card reader
\n8 Digital vidicon
\n9 Digital sound recorder
\n10 Bluetooth
\n(snip)
\nIC card reader<\/strong>
\n* Read the information of IC card in display screen
\n* Rewrite data<\/p>\n

Radio Frequency Identification(RFID)<\/strong>
\n* No need to touch against the device<\/p>\n

===================================<\/p>\n

Tobacco maker group hands over taspo user data to prosecutors<\/span><\/h1>\n

Japan Today, Monday 27th July, 05:09 AM JST, Courtesy of DR<\/p>\n

TOKYO \u2014<\/p>\n

Link: http:\/\/www.japantoday.com\/category\/crime\/view\/tobacco-maker-group-hands-over-taspo-user-data-to-prosecutors<\/a><\/p>\n

The Tobacco Institute of Japan, the industry body of tobacco manufacturers, has turned over vending machine use logs on cigarette pack purchases by certain individual smokers to public prosecutors when they requested such information for investigative purposes, informed sources said Sunday. Such logs of \u2018\u2018taspo\u2019\u2019 smart cards included records on when and at which vending machines the smokers bought cigarette packs, as well as their dates of birth, addresses and phone numbers, the sources said.<\/p>\n

There has been a case in which the provided logs helped investigators find a person who had evaded some fines, the sources said.<\/p>\n

The institute issues to smokers in Japan the taspo cards which entitle its holders to buy cigarette packs at vending machines. Taspo cards are issued only to adults aged 20 and over to block smoking by underage people.<\/p>\n

This appears to be the first time that the use of taspo logs by criminal investigative authorities has become public knowledge. The use by such authorities of credit card-related information and mobile phone logs has been known.<\/p>\n

The institute handed over taspo logs on a voluntary basis in response to prosecutors\u2019 inquiries based on the Code of Criminal Procedure, but users of taspo cards normally do not assume that there is a possibility their taspo logs may be used in criminal investigations.<\/p>\n

Some critics question the appropriateness of handing over such records to criminal investigators from the standpoint of the need to protect personal information, arguing that the institute should inform taspo holders beforehand that it may turn over their logs to third parties.<\/p>\n

An institute official told Kyodo News, \u2018\u2018We have kept track of purchases-related logs to check if taspo cards that were stolen or for which reports of loss have been filed may have been used illicitly, and we basically would not provide them to third parties.\u2019\u2019<\/p>\n

\u2018\u2018But we cannot help turning over such logs as well as the addresses, names, dates of birth and contacts of cardholders to investigative authorities as necessary if the authorities request the logs in writing in line with the Code of Criminal Procedure,\u2019\u2019 the official said.<\/p>\n

\u2018\u2018Since Article 23 of the rules for taspo cardholders stipulates that cardholders consent to the use of their information by the institute if the institute takes necessary measures to protect the information, we assume that the article also covers logs on their purchases,\u2019\u2019 the official added.<\/p>\n

The institute has handed over to investigators such information as the dates of birth, addresses, phone numbers and dates of issuance of taspo cards of certain persons, as well as a list of when and where the cards were used, the sources said.<\/p>\n

There have been cases where the institute turned over copies of applications filed by taspo applicants, alongside the copies of their identification cards such as drivers\u2019 licenses which the applicants had attached to the applications.<\/p>\n

Taspo logs could help their reviewers figure out what areas cardholders live in and what behavioral patterns they have.<\/p>\n

Through the provision of the logs, the Saitama Public Prosecutors Office was able to identify a company where a taspo cardholder who has evaded a fine worked as the cardholder used a vending machine on the company\u2019s premises repeatedly, the sources said.<\/strong><\/em>
\nENDS<\/p>\n","protected":false},"excerpt":{"rendered":"

Last May I put out an article in the Japan Times about the (now approved) IC Chips in revamped Gaijin Cards. How they would enable the police forces to remotely track foreigners in a crowd, and how data would be less secure from hackers.<\/p>\n

Not unsurprisingly, I was told I was exaggerating. But it’s hard in this day to exaggerate the reach and rate of development of technological advances (who would have thought we would have this very medium to communicate through a little over ten years ago?). So here are some sources showing how 1) ID Chips and RFID technology is eminently hackable and remotely trackable, 2) how police already have IC scanning ability in their walkie-talkies, and 3) how the Japanese police in particular are using ID cards beyond their originally-intended purpose to track crime. I don’t think I was exaggerating at all. <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33,5,4,10],"tags":[],"class_list":["post-4008","post","type-post","status-publish","format-standard","hentry","category-fingerprinting-nj","category-human-rights","category-japanese-government","category-japanese-policeforeign-crime"],"_links":{"self":[{"href":"https:\/\/www.debito.org\/index.php?rest_route=\/wp\/v2\/posts\/4008","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.debito.org\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.debito.org\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.debito.org\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.debito.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4008"}],"version-history":[{"count":0,"href":"https:\/\/www.debito.org\/index.php?rest_route=\/wp\/v2\/posts\/4008\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.debito.org\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4008"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.debito.org\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4008"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.debito.org\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4008"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}