RFID could offer enemies a window into Defense supplies
- By William Jackson
- Feb 24, 2004
SAN FRANCISCO'Researchers at RSA Security Inc. this week will demonstrate a prototype tag to block radio frequency identification devices at the company's annual security conference.
The device, RSA officials said, will address privacy concerns about the tiny RFID tags retailers say they will embed in consumer products within a few years. But of more serious concern at the Bedford, Mass., company are potential vulnerabilities in RFID systems in use now at the Defense Department.
DOD is using the ID tags to gain total visibility of its supply chains. But RSA Labs director Bert Kaliski said the tags also could open a window for espionage.
'I see that as a much more important issue than the consumer privacy issue,' he said. 'RFID won't get to the consumer for a number of years. This is a homeland security issue.'
RFID systems use small transceivers that can be read with remote devices to track products and materials. The commercial sector is adopting the technology to improve inventory control. Currently, companies mainly use the tags on shipping pallets and containers, but the next phase will be introducing them at the product level.
DOD has cooperated with Wal-Mart Stores Inc. to define technical requirements for tracking shipments from vendors using RFID. The department wants to eliminate the logistical logjams that its paper processes create.
The Army began moving toward just-in-time logistics in the summer of 2002, when Gen. Tommy Franks, chief of Central Command, ordered RFID tags on all materiel shipments to troops in Afghanistan.
In January of last year, DOD laid out a policy to require the tags on shipments for all future military operations. Through the In-Transit Visibility network, the Army has used the RFID tags in Iraq to track everything from boots to bullets.
DOD has said the RFID technology is an improvement over previous supply chain management systems. But Kaliski points out that what can be read by DOD also might get read by others. The problem is not in the RFID tags themselves, which are too low-powered to leak much information but in the readers.
'In some tag-to-reader protocols, the reader tells too much about what it sees,' Kaliski said. 'That raises an espionage concern.'
For instance, sophisticated technology for picking up faint radio signals could be used outside a port to monitor RFID readers tracking DOD shipments, he said. Information about the movement of even routine supplies, such as boots, could prove to be valuable intelligence.
Researchers at RSA Labs are looking at ways to plug possible leaks.
The prototype tag for personal privacy is a small device that could be worn on the person, blocking outgoing radio signals much like wrapping yourself in aluminum foil. This would neutralize RFID tags that manufacturers expect to embed in clothing items and even some currency.
The blocker is essentially a modified RFID tag and could be developed as a product relatively quickly if demand arises, Kaliski said. Protecting DOD's supply chain management program from RFID leakage could be trickier, he said, because it would require protecting data, not blocking tags.
'With the tags you can't do any cryptography' because they do not have enough power or storage for such functions and probably will not for the foreseeable future, he said. So the security models built on cryptography will have to be rethought, Kaliski said.
William Jackson is a Maryland-based freelance writer.