deepest teaches several %ah course there and
I also were for myself I have an office in Portland Maine
and said open one in cambridge massachusetts hopefully and I
help people set up tech companies by I'm here because some research I was doing
at the University
over the past two years I've had students who were reading about to be
alive
Real ID Act and about security vulnerabilities with RFID
and last year had one student do
a paper on that and this year ahead for so it's so
it's a topic that a lot even computer science are interested in and
a lot of attorneys from the law school been interested in the subjects as well
so I thought I do a little research
and present to you some research that my students brought to me and
homes in which I didn't on my own it's not it's generally not technical
research
what it is is a I'm talking about the law's legislation
and privacy issues I I'm really for
civil liberty protection so I'll talk a lot more about that now tell you a
little bit about passports
the new requirements for passports 3
requirements for getting a driver's license in some states it's changing
um so I'll tell you a little bit about that as we go on
as my professional background as I mentioned
I'm a professor she said the main and I at work for my companies and you'll see
networks
as is my educational background it's sad
not as important to to 1 I'm talking about specifically today
except that I've studied in three countries so every country that
I've I study tonight I like to learn about the the technical culture there
the legal environment and policies regarding civil rights
I'll talk about the history of RFID just today
and and this is an historic a presentation but
its kinda important to I think we're talking about the tools and how the
technologies used
a description of the technology tracking a good some packages such as
documents mostly biological implantations insertions party my
backgrounds
also in biology a I love computer science and biology in
back in college a I like to study a lot about viruses and the biological Tay
and then in grad school I started setting up more about on
about the the digital type and they're fascinating added
the similarities between the biological and Israel virus is really quite
intriguing and the Real ID Act what it's going to mean for you
when there you go to get them your driver's license or you wanna walk into
a post office or open a bank account its gonna change the way that
that you do your day-to-day activities and the way the business is done
and I'm gonna be this year because you can't read message I think especially in
the back
but and a blogger wrote about this a few months ago
and I thought it was it was kinda it was for fascinating the State Department
today has unveiled plans to improve a national ID Act put into action twenty
years ago today
on May 8 2008 the citizen was required to carry a card containing their social
security number date of birth physical address
various parametric features as well as an RFID chip
the RFID chip has made tremendous strides in its ability to help the
public
failure to carry the national ID card resulted in print imprisonment as a
sponsor an anti-government actions
these tears have been removed from society and pose less of a threat than
ever before
today the government has made the process even easier an effort to prevent
pollution from the plastic required to make a national ID cards
you're invited to get your new compulsory organized RFID regional
universe no personal tech
right for short correct will be implied in your form and provide you the same
great benefits you have grown accustomed to
some others benefits you already take advantage at using its technology
traffic officials have been able to locate congested driving Aires by
track and Tara tracking individual drivers with this information they've
been able to
reroute traffic to other areas police officers have used this technology to
locate criminals and missing victims
statement department stores have use information gathered from your
purchasing habits to better produce advertisements that are important to you
I'll debit credit and other financial accounts a condensed into one card
reason I chose this is a he's writing as if he were in 2020 a
um there are benefits and detriments to
any type a technology whether it's a an old fashion or even new lock picking kit
lot picking tools from when I under center generally not legal
to you has asked especially carry with you if you fly airplanes you
wouldn't want that coming up when you're going through security but
the lock picking set in itself is not something I consider to be
evil it's not bad it's what you do with it and how it's used
and I think the same is true with RFID it has great benefits that can provide
is actually it's I'm having a fantastic time
this is that I governor the RFID tags here playing the game
but also every now and then I had wanted to pop the battery out
headquarters in the hotel I have that option to but if you're carrying a
national ID card
that is your driver's license and you're supposed to carry it at home
produced well in some states you have to carry it and show it upon being asked by
police officer
on you have to carry with you at all times and there is no what you can do to
just
you turn it off are talking about passive and active the difference
between the two that
how the attack technologies applied was what makes a good or bad
not the technology itself I think well for the this is a good example the
history of RFID is in 1939
it was used to tell friend from foe and I guess you could say it was good or bad
depending on which side you are on
they invented an a there's a leon sarin invented the soviet espionage listening
device
and a passive radio transponder was 16 the memory was and then in 1973
from what distance Kenny singles as signals be receiving it it depends on
what type of RFID device you're using
um this was interesting when I was at Def Con I think it was
maybe I can remember maybe about four years ago I'm a couple in
guy show that from a passive RFID device could be picked up from 69 feet away
and they had a directional antenna I have some photos are then I'm gonna show
you next but
it some and a lot of things that I've read
I don't think a lotta congressmen and senators really get this that
and it's not half you can walk into a building and expect
that your driver's licenses is gonna remain in your pocket and yours and your
ID is
is you could be anonymous or not um
it's not something you can take for granted anymore
so the bad news is and if you work for one of these companies where r fi di
security
your card you know you to get into buildings relies upon the physical
distance from a reader that's night
this is not good in these guys were some the first to show that in
this was on I borrow these photos from Make Magazine
and I remember when this was done and upcoming it was a really big deal at the
time
on these are the directional antennas that's a box that they put together it
was a very expensive and there is an article in make about how you can do
this yourself
and other guys today and just look on make
magazine dot com if you want to learn how to build room your own
components have an RFID generally
if it contains an integrated circuit for storing processing information as well
as much winning Indy marshalling
for an RF signal has an antenna catch up with our values are printed directly
onto
ahead onto paper onto I read that maybe the post office may be doing this for
some stuff that they like to track
tracking a good social retailing and
this is something that i think is is pretty interesting that I think a lot of
young people are going to be using this as an
when they don't know there's our Site C and some other clothing
that kids are trying on cuz I think right now a lot of the
really high-end retailers especially in california are putting these and other
close and you walk into a dressing room put your stuff up on the hook
and you can tell your friends hey this is this is what I wanna buy
what do you think about it on you can then walk up to the cash register to
keep track
love all the items that you had been there and with some credit cards I don't
have any have
them right haha some credit cards you don't even have to really take it out
and have it be scanned it's paid for a few
if you choose and there's a these are some other clothing
the articles of clothing that contain that I mean there are many but this is
just some I found an RFID Journal
um and now I is from social retelling on a talk a little bit about
other types a bar fight d this is not RFID this is radioactive dust
and radioactive dust was used in the nineteen seventies
their plane would fly low over a bunch of insurgents and drop some stuff on
them
and then all agents would have to do later on is going to attend the Geiger
counter to see
what what came up and
they can track people later after two then after the group has dispersed
and I thought about this um when
I was looking into RFID powder and
Hitachi said that it's for anti-counterfeit
on purposes putting it into my
and two dollar bills on but its it's very small
and you can really see it I have a picture next about how tiny it is
but as if this wasn't small enough they made it even smaller
and their nests and if that dust was blown
into a room at people think that a it would be hard to detect a I think
and then you have to wonder about why isn't this
the small I don't know what I touch is doing with this I guess it's going into
even better anti-counterfeit
and head monetary a monetary seasons but a
I don't it's pretty small and it reminds me of the angel dust story and my dad
spoke a little bit earlier today he used to be a
you CIA agent nineteen seventies and he told me a lot of stories such as this
one
and about the angel dust and now in
in my generation I'm thinking about this one when I
we talked a little bit about the industrial activity and what can be done
with this
um the documents this is something that
thats I'm most interested in is %uh personal identifying information
that connects you to all the purchases you make
from when you drive a 95 with your transponder its RFID
an it's connected to lot of people that has to be connected your credit card
and i miss u wanna pay cash and then if you're going through New Jersey as i've
discover how many trips between I live in Maine in DC
it's really a hassle they make you go through a lot if you don't wanna use
your
on the EZ Pass now you have to pay cash in any way in line
so it's becoming more difficult to stay anonymous in today's society
and especially documents and credit cards
on like this one for instance they knew about some of the security flaws and I
think just like
a lot of arm very eager suffer Company shall we say
they wanted to get their product out to be one of the first to do it and the
kind I think about security later
and from coming from in the engineering department
and cue well computer science department we talk about how to teach students from
the bottom
hot how to engineer systems from scratch and build security
into your code because if you just put out something that works you know well
well great maybe you get beyond that has helped but to make something
that is not just you don't release it into the public
just because it works but make it smart make it smarter
and include security in your code is there are different ways as I'm sure
many you know out there
at had a design hardware and software from the bottom up to make
security party for design and not something you to stack on leader
and that's one of the criticisms I have from a lot of these companies they can
attack the security on Weiner
on there's a US patent application that was filed here for american express
it calls on it's for consumer tracking consumers
to watch people in stores and if you thought wal-mart's
wal-mart was bad enough they put ours ID tags on a lot of their products right
now
and they don't tell you about it there have been a few cases about this but
on wal-mart says they're using it for management purposes so that they can
tell us a lot of people are around this
this type of shampoo where this this product and they can move it out to the
end caps
and I we learned about this business school have this was a really great
thing and also for inventory tracking in this
black I think when they apply it to people who walk in the stores
and they really but it is on for privacy purposes if you walk into a public place
like Walmart
and they have surveillance cameras you don't have an expectation
a privacy wherever you go in that store you know other cameras there this
weather and now in the pack much they put up those big size
say like surveillance cameras in use um
whenever you do in that store day Dame they watch that they store it
and the question it's questionable to me is how long do they keep that
information and what purpose the user is really for marketing purposes because
a a lot I've you their faces on there too and I read some
somewhere that sum up the surveillance cameras can use and
a geometrics for your face to be able to determine
who you are it doesn't work very well right now but
it's getting there and well for
American Express's patton the businesses would pick up the signal used to
identify shoppers track thomason observe their behavior
an american express senior executives vowed that they wouldn't do
RFID based consumer tracking without providing notice to consumers
and as I get to know what it later on a couple states have now passed
on pass laws that say that if you're using RFID
you hand and the card or four different devices you have to tell consumers about
it
the problem is more states have passed laws like this but I hope it's coming in
part the reason I want to give this presentation is a
and other people Cummins conference from all over the country over the world take
go do something about it because I'm unfortunately I believe that most amor
senators and congressmen
don't have a really good grasp on technology
and but people here do and what you can do is write letters to your Congressman
your senator
and say it was from this is not OK to Real ID Act its is we're just not ready
for that yet here in America do something
about it and wait a little bit before some until some the security kinks are
worked out in this before this becomes something that all of us in america have
to carry
and as I get to the very end the presentation the Chinese are already
carrying RFID
identification cards and has a lot of very personal information on it that
the people in China don't really know specifically what's in their file
anything even if they do what they do how do you get that out with the chinese
government
on lol for example with this American Express credit card
and it reminds me of a scene from Minority Report tab
beds in on this you can display a moving or static image a performance have a
sound recorder even emission test that while you're walking through restore
that would really annoying me instead of just the perfume girl said that the
department stores it would just
you know you wouldn't even know where they're coming from even be able to
avoid them it would be
it would just be you are John Smith you must like this
sup particular brand so we're gonna for you hit you
just fab this clown unknown security vulnerabilities as I mentioned
the No swipe credit cards on are been a problem
I heard that the security and encryption is pretty good but it's not rate
a member of the Senate Banking Committee had denounced RFID does my credit cards
at a press conference and this was in 2006 0
have far we've come you know from 2006 not a great deal
but one of the senators said that town contracts for this card should have
morning boxes disclosing
the known weaknesses that this technology and he pretty much said that
he may as well where your credit card information with the big sign on your
back
and there now you may have heard about these guys at the University of
Massachusetts in Amherst
one of them got it new credit card in the mail and it happened to be RFID
enabled
I'm so he was able to without even opening the
the envelope he was able to determined that
his name his credit card number expiration date
this was being he could read this without even opening the envelope which
I ever the converse NYers blog someone did this with passports recently to you
didn't even have to let open up the envelope and take the
the you know the passport out other must've been open a little bit inside
but they were able to get digital photographs and and all that just in the
mail by am getting it out of someone's mailbox who was
part of this who knew what was happening and this is
I want the professors here the this is one of the experiments they did they
said okay how can we make this a little bit better
I there he got you have the name has been transmitted without encryption
which is
which is really a surprising and in plain text
couple together he called us together for a pretty cheap a mountainous was
this was a a while ago and I think you could probably make this for
a lot cheaper a couple my students were gonna make some RFID readers they said
they could do it for about
twenty-five dollars on our department didn't want to spend
the money on it at the time but we have more interested in part now but RFID and
maybe
that's something that on the students will put together next year
the solution I they came up with a method that uses the concept of random
numbers which are used to encrypt the data that is being sent by the tags
produces a line a random numbers you know that's that's easy but RFID tags
are the sizeof
a matchbook and the circuits are really tiny and that they not been able to
handle the random number process
and this message relies on the fact that sound memory cells in the tech news all
this information that is stored and then when the power supplies removed
now I want to talk last night out a little bit about have that maintains
that bad
I'm so the University Massachusetts some solution was when the tag is powered up
by the receiver some the memory cells fluctuate
between the two partners States before they settle and this is what they used
to create a series of numbers that allow they are fed authenticate itself to
reading device
well I went to the talk last night about the Col du and
this this may not be on this may not be
something that that is the solution but
the this is their research and I think it was was better than
with pecan in the mail which was no protection on their card at all
eye-tracking a car's and this is something that had the press recently
I think about a few months ago I read a lot about this but on
our flight D is not an OnStar but if you have a car that has OnStar really the
only way to
to turn it off is to sever the power to the device
on just getting into the car computer and saying turn off it doesn't work
um so when people buy OnStar all the sea
I think the general consumers all they see the commercials where he had a tree
OnStar signals to EMS you come get me I'm here
um but it can also be turned on by law enforcement
and it can be turned on possibly by my hair
people that are participating in malicious hacking and
that's one of the reasons when I was looking in a car right shows one that
did not have OnStar
and perhaps most people would choose an OnStar vehicle
most people I think general consumers would but they
been thinking about this like people ask me what what's the problem with OnStar
do have something to hide I get that question a lot if you're trying to be
anonymous in society
why you know I'm what's the problem with that and it's just it's not the fact
that it's something to higher but it's the fact that
it's a little bit a civil liberties that I wanna try to maintain post
posted with the DMCA the Patriot Act
I will these combined together it's becoming harder and harder to do this
and we get a lot more questions and I've talked I just had to another
where the yesterday like I talked to Alex and he was saying that it's
becoming really difficult
to work in the legal profession and be able to
say hey I got a hacker conference is because people for stuff like well
you know that's a lot of people asking what would you wanna do that are so many
criminals are like I'm one actor conferences
sensor and eight years ago up
I
well her I'll tell you what are the reasons I
got interested in doing this is on when I was an undergrad school I was a
Carnegie Mellon
and I just heard a little bit about what was going on with kevin Mitnick
and what was going on with Bernie s and it really upset me a lot
and thinking can I do about this I was I felt like
I her Kevin speak many times and when his presentation tonight
I heard him say you know I I know I broke the law I did these things
but I don't believe that the punishment really was was fair
and I've read about the way that the just
the judge reviewed his case being able to
whistle tones to connect to the internet when you're in jail the launch missiles
I thought that was a joke when I heard it and I thought how could
you know it's a I thought that people in the legal community amenities YouTube a
customer to go to law school record become a judge me you really gotta
can be really smart to do that okay well yet maybe
be there they're very smart people that do these things but they don't have my
background in technology
and computer science or with it. and what scares me is when people like kevin
get into the system
you're in a system with most people that don't have any background in this
so are you gonna get a fair trial I
I worried that that the answer was no and melodic cases there people by
Jennifer granite that
she was when my inspirations to an and what's yeah this is great
and went to law school because these things bother me
and I wanted to figure out like how could
when Bernie s was in jail why did they put him in a jail
with on some pretty hardcore criminals and I i kno he had some
some pretty bad experiences in jail he was beaten up in jail I'm
heard this on a presentation he did I think hackers in jail
the last hope that I'm 22 years ago and it bothers me so
on that's why I had developed a background in technology
and I am attorney and what I'm trying to do is to educate
people in the legal community people making legislation
and just to be able to say hey there there a lot of people out here and I
want people to come to these conferences that if you
ask for some help if there's some aspect if the techno what you don't understand
there's some people they care so much about these issues no comments here
to tell you about it I mean that judge caplan
maybe he kinda a California he heard the Microsoft case
I think that if he was more open to
a lot of people from this community saying hey I'll tell you about what this
means
I'll tell you what does patton these patents to differ in history
and I think it might maybe it'll change a little bit of the judicial system and
how they handle have
on hackers so we'll have fewer hackers in
and presents a specially in town in have
like the maximum security prisons I don't get hurt hot that's really
unfortunate did you have a question
a multiple question on I'll take the others afterwards if a
could you speak up for one microphone speak up
okay hope
want these sick
is that 3 for in law
from because most people focus on
reading the wall him
is there any crosses road track
free for judges and lawyers
Z
day
frykowski you
you
yeah I'm glad you asked that question because I mean every phrase is for
people who didn't hear
the first by the question is is there any training for
law students are there any programs you can do in the answer is yes
and is there any training for and I'll tell you all my little bit more about
that in the second and is there any training for
or judges and is there going to ever be a special court system
just for computer crimes and I think know for both for those unfortunately
but I'll tell you a bit more
I had the privilege of what I want to learn I wanted
main up School of Law and other reason we settled on Adams we're in Seattle my
husband was was working for big
suffer company out there and we wanted to go someplace to the ocean near the
mountains and I got a mainline I interviewed there and they said hey we
have a technology Law Center
so Mike great it's near the ocean I surf I has a snowboard ski for
XI I get there and its virtual an email address
and I was like man this is this is really tough because I night as the
school for
months reasons that was a really big one so when I got there one beef
there was a group a technology in law student group and they still exist if
they have a different name now
and but they we got together we ordered pizza with our budget pretty pets
and we talked about these issues me we had done
we had some seminars we once a month we try to bring in
speaker to talk to the law school and the students about these issues
and it was pretty successful from what I hear now the group grew from five and I
was there to their over 20 who regularly attend
which is great because some we're also getting more people with computer
science and IT backgrounds applying to law school and we need more
we definitely need more because I think it's really I love you
when you choose to if you choose to go into law on
traditionally to study this like I did you have to take around an intellectual
property because a lot of what goes on with with computer crimes has to do with
well a lot of what you learn about the cases is when
contractor violated their usually intellectual property violations as well
and corporations care a lot about that but what I'd like to see more
is the criminal law developed on the criminal our programs Moscow developed
to include a lot more a cyber crimes
and main school all right now we went through an email address
to now they have a center for innovation and technology they have clinical
programs where people can come in
and I take cases there mostly in IP right now
but I have plans to try to combine the computer science department
and the law school in your program where we can take more cyber crimes cases
federal
we don't have a lot on Main going on but for federal cases
I could take people from all over the country to work on that and I have some
people interested people my method of kind
to last year who were law students so and that so many people who are going
into law that I'm
better from it. in CS backgrounds it's so fantastic is when I applied
I felt like kind of like when we've read cases like on
reread a record release cases and manuals QC is Kayson
remember I'm people would ask me about it I did the presentation for that
because I am
a I really enjoy that type of law and after that the professors every time
they say it hacker they kinda look at me
and and be like yeah yeah I know their case and
yeah I am hacker now tell you why that's not a negative turn
even in law when you read a lot a legal cases they still say hacker hacker is
as in a malicious type but sad now it's it's changing
and but we need more people in nineteen CS to come into the field
and and and I'll tell you are smart enough to do it
I mean if you can do for discrete math into a lot a program
and you're gonna be able to have a law school just fantastically and I'm really
glad to hear that they're more going into it as for the judicial program
I've been working on trying to set up a nonprofit group I
I'm trying to name a hacker law and having a little bit resistance and legal
community because there's still this on the way as mentioned the idea that
hacker mean something illegal
but I wanted name hacker what I wanted to set up a judicial training program
where do judges have to go through continuing traditional
legal education just like lawyers do so in addition to educating summer the
older lawyers for their continuing legal education credits about cyber law
cybercrimes
that's not just intellectual property about patten's it's more about
so many cases you really it would be nice if some other judges actually knew
how to analyze code
because I truly believe that when someone's being prosecuted for a crime
on if it's a computer crime it's kinda like you look at
they look at the results okay this is what was broken this is what was taken
this is the financial amount that
that is at stake in this case on that phrases like sign in the humidex case
claims the damage
but if you actually look at how the crime was done I believe it you have to
open up a coded take a look this maybe doesn't apply for the script kiddies
but for people that are being tried as some because
I love you in here if you commit a crime in many view know if you
have done some time I'm you're considered to be experts
so even if you were seventeen you might be tried as an adult because they look
at your
on the gym the legal system looks at you what you can do
as being on elevating your back from the criminal aspects are you might actually
get more time
because and because you're your your really good CS
in nineteen if the prosecution can prove that it's more difficult for you
but if it comes to I often look at with the regular case is a criminal act like
if you break into a building
and how you got into the building is very important that can show intent
and so there's a difference between as you all know just releasing call that
other people have written that the script kiddie thing
and a lot of them don't really have any idea about the damage it can cause
I guess some you know that Morris is kinda on with worms
kinda like that in that case that he really had no idea that was a good
defense
but that doesn't fly so well anymore so
I believe it'll be great if judges and lawyers could break down the code or
look at the hardware that she used to say okay let's see
how much intact how much planning was in part because and other crimes makes a
very big difference
so on and thank you for asking that question because I i would like to see
more education for judges and lawyers
and who were kinda from the from on a lot of them are in their forties and
fifties and this wasn't
they're there for in the forties fifties age and that this wasn't something that
they studied law school was all about contracts property
on and now even when I went to law school if you were interested in
computers you have it's really the eye and watch for property track
so thank you for asking that question I
as though I admit I devote about tracking a car's gonna have to mention
that
and review that 2004 I think it was too hopes ago nothing face presented hope
about the benefits of hacking your on-board computer
one thing I gotta say is not much about the MCA with that
but there are going to be tire pressure monitoring systems
in cars on well actually there they're here now
but in a 2005 National Highway and Traffic Safety Administration issued a
rule saying they have to be in there
on one of the problems is is that you can read them using a directional
antenna you don't have to be ready like right up close against the tire
and that concerns me for security purposes and
if if it does have a unique identifiers you wanna know
if someone is going to a specific location
if you if you follow them out when on their driving around in town
find out what that uniquely identify risks and then
I set up a reader wherever you think they might be going
on and you'll see you know if you'll be able to tell if they're they're not
without actually
being you won't have to be there you don't have to physically approach them
in
you know say hey I have you been there don't the information will be there
and okay government-issued ID
what were the results of the secure password trials in the Netherlands
kisses will be different in the credit cards that I was talking about
I have a lot to say about passports I have to I'm a citizen the US in a min
I'm also a dual citizen of Latvia
and um by have my US passport
I renewed right before an RFID came in on as mandatory but my life in passports
probably gonna contain RFID
so actually yesterday I went down stairs to the second-floor apartment as wallets
from a nice guy name a
Michael I believe in that its if my passport my passport not gonna be open
it's not going to be able to be read if I haven't won it is well it's the best I
can and I got one from my
my dad's you can see he has let him pass but as well but the secure pass for
trails in the Netherlands it was cracked
so fast I think was in like manner hours
on it was read remotely and then the security
cracked the flaws using they were built into the system
where and other biometric data could be rad and
the skimming exercise was was concerning and this was back in 2006
on this is hard to the same case after intercepting the data security can be
broken on a PC in just two hours data birth visual image in fingerprints were
all they're out in the open
secret he is made up for the passport expiration date birth date and the
passport number stored on the passports machine-readable zone
what was that most bothersome to the computer science students I tell about
this
is that the last digit in the number is a check some
that's one an introduction to programming that's one of the things you
figure out if I call you think some worked out right that's like I've really
control thing
how did that get into the encryption for are you know these passports
contract is yet I'm gonna get in and co-write
my passport is the the one on the left
the one on the right is my two-year-old son's passport has the RFID
and there's nothing there's nothing that I can do about it
although on I'll get to a word article that tells
that can suggest something you can do about it but you know that you put your
passport you his password is not your property
it belongs to the US government so when you mess with that mess with the US
government just to let you know give you warning about that but
I one of the things we didn't we renewed our passports as we don't give our
social security numbers out for anything except for taxes
and even then my had two kids now and we did not
we was such securities for them until their ready to decide on their own
because it is being used as a national ID number there's a doctor in Maine you
wouldn't treat me because I wouldn't give them my social security number
I told my health insurance doesn't even have it they don't need it
there's no reason for you to have and they said well you know our database
that's the key for it
said you know what that's not a unique identify the right people at the same
social security numbers
and they said hey sorry we can get you in a system we can't reach you
so I sent them couple letters you know letterhead from the university and I
said you know that that's that's really
that's not good so Michael what I'm
when I'm suggesting here is on you don't always need to disclose your social
security number but how that to the US passport office
I'm with someone from a government agency asked for your number they are
required to provide a and the 1974 Privacy Act
had requires disclosure it's a notice which is required to tell you what law
allows and ask whether you have to provide your number what will happen if
you don't provide it
so if you turn over the application for password is what I really scary wording
on the back
but actually um there's another computer group I'm so psyched to see this was a
arms computer professionals for social responsibility group who have
they have a letter that when you reply for your passport you send us with it
not tell you how her down for me
we apply for password you can refuse review on your social security number to
the passport office
and instead mail a notice to the IRS it's kinda like you're doing business
with the government
when you have to know your social security number to the IRS because some
your well that's that's how the tax law get on with this
and why the IRS needs it but the passport office really
doesn't I'm if you but you do have to do is give
only your social security number and onto the to the IRS and notified
passport office that your giving us to the IRS
so I'll tell you what happened with us on here's the letter if you go to the
website
i'm for computer professionals for social responsibility .org they have a I
can letter here
and this is the one that we use almost exactly and don't tell me this now under
saying that and when I post this if you wanna
on take a look at the letter Veritas sorry on how this works for half
at the same time my husband I we didn't do the joint application because we
wanted to do a little bit of experiment
I'm we both male and our separate paths for new applications without disclosing
national security number on the on the form
including the envelopes was a letter to the IRS and certified mail with return
receipt
so that we can confirm that the letter disclosing our social security numbers
to the IRS was
on open by the US passport office was put back into the mail
and sent to the IRS all right if we get the returns he's back
yes okay my husband's return receive was returned as three weeks
after mine was return his look great
it actually was sent and received no cent to the IRS received by the aris you
can see the stamp
the stamp their okay now here's mine
a Citigroup somehow got mine and I have no idea how to write
and there's also a big boot print on it I guess it didn't scan very well I don't
know where this thing when when I suspect happen
is someone at the US passport office actually did open up my envelope this is
why we set the application separate a/c
and then they look to me said up I know like a crappy we gotta put this back in
the mail I do you know anyone who can stamp this was something just a
so this person's happy when I get the returners the back so maybe some with
Hannah someone works Citigroup with stamping
and this would happen in mine came back on very strangely very way
sewer I guess I'm gonna rights to on the guy who have from the computer
responsiveness confessions for social responsibility or maybe cinema DVDs
and tell like a we had a fifty percent you have returned on this
bed nitsa it's a start so if more people know about this
on you can give it a try but hey this is a legal information I'm giving sewer
don't take it as such but add we we give this a try we have other experiments
that we tried if I have time I'll tell you about a few more them
about carrying ID's the airports to you but the Real ID Act in citizenship
just talking a little bit about citizenship and the password and check
this out a guy
um in new hampshire claims that he's a citizen a new hampshire not in the US
and got a US passport
so he did is so he didn't have to pay federal taxes
he disagreed with where tax money was spent on
this is he said that when he took if you watch this video on if you go to this
this URL there's a video he tells how he did it
he said that he took his application to the passport office in boston they said
this is not the first time
we've had to do something like this for people claiming you know they live in
Irvine
issues with the live free or die state so on which is new hampshire
and so that is one way to someone's got the passport a different way than
and then I did i right what's on your passport
depends on the Asian country American passports containing gender birth date
and birthplace I'm your passport number issue date expiration dates additional
version ever photo
and they say their social security number and address and not on the chat
and the state department says that the chips friends about four inches and i
cant be ready when the password is fully closed yeah I want to render
random and said he was right %um his presentation last nine
yes but if your passport open just a tiny bit and your pocket
that's when there is some security vulnerability and
I'm I'll actually in passport additional photos on it right now
but by 2009 my fingerprints are gonna be on it so I am gonna renew before
that happens and wait and eventually in 10 years I'm gonna have to renew again
by then maybe the security flaws will have been worked out
either damn biometric data on is if you get arrested now for a federal crime
on the FBI's gonna take a lot of pictures your tattoos another
identifying information
and their story in a facility in West Virginia and um
what said they're doing with that um and as the guy
give a presentation this morning about surveillance devices it's in your
it's in your on FBI record what's in it and how to change it
he claims it's not possible on I I don't know
the truth in that I don't personally know any FBI agents but I I do know is
very hard to find out what's on your record unless it's a criminal record you
know what you can charge for
but other data that they collected on you it's there so
on one of the things that I've been cautious about is there some airports in
Europe that when you go through they take biometric scans and I know one of
them is Frankfurt in Germany
and I'm trying to find that airport I fly other places where I need to go to
Europe because I don't really want that data
and some database about me right now but its peak getting to the point where
if I don't want this is going to be really tough to fly through Europe
because on
somebody scans release: difficult to track and fax near impossible
so if you travel Europe ally itself it's gonna be on someone's database it might
even going to some bar fight
your party or passport if you go through those countries
you right now you say the only have to give biometric if you wanna skip it
I have it be you passports why might be able to get around some of these
but for those of you that don't have to westwards more when I travel light
I don't and I don't Schobel for them that's really bad
but on this night illegal but it's just not a good thing
who wrote the encryption for the passport okay this is something that I I
was shocked when I read this in washington ties with the US government
outsourcing corruption developments were European company and that European
company had a company in Taiwan right the encryption
yeah this is bad on one bus he was talking about outsourcing some really
important security stuff
this is a great example if their that the US government said that the US
didn't have the technology to do it here in the US
yeah I happen to think it was more for financial reasons it's like a while
other jobs are outsourced
mmm good and Bangladesh okay yeah
passport encryption was stolen alright and
they don't they it was divall Shin report in October 2007 had finally at
The Hague that China had stolen
the patented technology and use for the past four trips
judgeships I believe it was the algorithm I'm GPO
on was use the was using the UN Security on this is not a thing was back here in
the US they were using on secured FedEx courier services
to send blank passports the state department offices until securities
concerns were raised
and the blank passports are really hot on the black market because you can make
that and
you can be anyone you want with service on
the GPO was forced to use an armored car company but the agency propose using a
for an armored car company vendor before the State Department no diplomatic
yeah services objected this was concerning
meaner government if they really that concerned about security let's try
I mean much these are companies are checked out really really well and I'll
tell you if
if a European company had a lotta business with a Chinese company that was
doing the coating I would say if I was working for the government
let's be a little bit more cautious about that and China's Great there I
think they're going to be the next for
your first home country up in common I'm but
they have a lot of security issues over there I studied law over there for
summer
and cash we had a to Chinese agents in our group they're americans
law students Chinese law students we didn't know who the Chinese government
agents were
bite on their kinda there to make sure that we weren't working for the CIA
our naval intelligence or something like that on but
china's not exactly our friend just yet so I will say
keep the stuff in the US for companies that have been checked out really well
don't outsource their
and how are the passports made this is important when you're thinking about
what happened with those blank passports being sent by FedEx and the careers
the computer chips are answered in the back covers the passports and the
Netherlands
by this company smart rack and now playing covers are shipped to a factory
in thailand
and to be fitted with an RFID antenna handling passwords eventually are
transported Washington DC for the final binding
yeah well on I I think alive you heard about this and this is why the concerns
I have when I carry my passport
if you become a pic my pocket cuz I do travel to some countries
and I've spent a lot of time a South America where I don't want people to
know more american
and I don't know which speaking was saying about I do try to blend I really
do.
Anza I when I think I was worried when I read about this
I don't have an hour for the past four but my my two-year-old son does and I
probably carry for him now anyway
but I when I saw this about they pulled is da me along a
a clothesline and when it got really close to the trash can
Obama simulate a bomb went off it was actually model rockets that were sent to
fire
when an american when a passport where by
it got the RFID from that and that was shown a black hair while ago and
um that bothered me a bit when I saw that so on
apartment as well it's today yesterday
I don't want miles I guess the other this happening are pretty slim but
I didn't like it when I saw that video if you wanna watch the video I'll go to
their web sites to the company's website and you can get on YouTube
alright I can't tell you how to do this because like I said your passwords not
your property is the US government's but
wired in article and this is a can
best approach the Sun is effin you know to do something with the antenna is the
use a heavy one object on it but I i cant say that that's a good thing to do
because it's it's illegal
but wire publish this so I wanted to pass along this information to you
washing it someone asked me yesterday about being in a microwave you to burn
marks
result Matt and I don't know from personal experience but that's what it
says here
and human implantation on I have a little bit about here
about the same here because a couple estates just passed a law saying it's
illegal for your employer to require
you to be shipped I remember at that that hope two years ago I think
and we gotten Mike she was like the way more dedicate my was she actually got
shipped for the presentation she showed how easy it wasn't an
elevator for someone to come up and get her information of her ham
on but at least it's still out there there's a company in New England that
does your car this time if you wanna work for this company they make you get
shipped and I think that that just on
it's just a violation number lot of things back
there are health risks associated with this and they you know various on
VeriChip knew about this from the beginning you can get a lot about
companies from the SEC statements like their
when they're on they have to disclose certain information to investors
and one of the things that came out in this where the health risks associated
with this
there it is that was really scary looking but that's how that's the device
they use to check people
and and and question is the saddam chipper
is a very ship that goes in people there's a grain of rice below the two
chips
a dime for I got this from home spy chips
someone really good book about that and
the top one is for you men's the bottom one is for animals looks the same
doesn't
it some it's pretty big and I also heard that when you wanna get it out they
don't really have that technique really
well well done yet so it hurts it hurts a bit
to take it out on this guy here this done its hasn't been proven
exactly yet that that it could possibly cause cancer but dismisses the dog here
that
that they did claim died of cancer from something from
the RFID chip and also you can have an MRI done on a party or body so if you
have a put your hand
and will you do for break your hand even MRI done
it hurt had in Auburn they're done
they've had some problems with them here this
their discs the average they wouldn't disclose a small bit easier for the
chipped a lot of people
on you date some people in a Las Vegas got shipped in a medical convention
I guess just to see what it was like and
there's there's the insertions aside from one to the chips
this guy's kinda saying well you know it's this is something that's
up-and-coming
on you just have to have to get used to this idea
some okay thank you
okay and this is what I mentioned you wisconsin says they can't mandate
implantations if you live in that state
and there's a huge fines for your employer if they make you do that
other states New Hampshire and taxes protests wal-mart's usage of this
it's not do generally about implantations but it's about some
walking around getting products and having them track you free crime
detectors this was another thing that I and looked around a lot for
there too and I wanted to mention I'm one of them is
if you work in Las Vegas in particular casinos
you're going to get a wristband and if your heart rate goes up
management's trigger that there might be something going down and
you know what's what's concerning the me as someone could just be thinking about
a stressful event that doesn't have anything to do with them stealing from
the happiest
it just could be that they're sick you could be a lot of reasons why
this would trigger but its associated with their name I love that
and maybe they track how many times someone's heart rate went up and how
that's a predisposition does that suggest a predisposition committing a
crime
I don't really see that look how far away three hundred feet that they can
pick this up
digestible RFID tags well I was reading I guess Cup kodak's diversifying
when I would think about digestible things I wouldn't think about Kodak
for Sabah but they say that these are fragile I can see how there could be
really great medical
on purposes for this on but I can also see how if you're on probation you're
not supposed to drink any alcohol or do drugs
you have to sit by a reader swallow something in this thing dissolves in
your stomach in a contest say what type A drugs in your body and how long
it's been there so I kinda consider that to be like a
a pre crime type device so on
admitted there are good applications in medical and research for this
personal RFID security I may go through this quickly
if you're interested in a jammer just be careful when I don't know that this
technology may tell you about is how it jams it's a different
and the SEC has some requirements you can't just the different ways a jamming
there is something that you can carry that on Jan your r fi di devices
it's called The Guardian okay this is a little bit about that and let me show
you a picture then if you're interested in reading more about this
on email this professor he's a computer science professor
I emailed a couple times I said my department would like to test out where
these things I didn't hear back from her neck think it's because I i'm in the US
those %uh view that are in europe you might be able to get a free or cheap one
for her for research purposes to test it out in their
is beyond URL if you're interested in that
Real ID Act okay I have some time to talk about this a pass in 2005
unanimously
and there was limited debate unfortunately it was part is done
it was part of a buncha bills that if you were senator congressman said in my
goal with this
you look pretty bad to use issuance and you will be required when you drive a
car board a plane
get on a bus or if you're on you want a post office
%uh I'm in a statement that was one other states have said on hand and new
hampshire
14 states that we are not going to pass the RFID
we're gonna actually pass legislation saying we'll never have our on the RFID
for the REAL ID Act
but unfortunately for man when you read why its financial
the privacy is Wilson is a number too concerned by financial is number one
and this is from the state also were senator Susan Collins just propose one
of the first %ah crimes bill
which is is worrisome to me home she's really involved with Homeland Security
Department but I feel like she
maybe a lil bit misguided with some other concerns about homegrown terrorism
but on stay if so what the federal government said people in maine
is it sure you if you go through portland's airport in Maine
you're gonna have to go through supplemental screening and I tell you
something briefly about this
if you're flying domestically you do not have to
okay is not required by by US law that you have to carry an ID
TSA once you have one and when you check bags you have a contract with your
airline carrier
they may require you to have ID but he got to TSA
say hey I don't have my ID with me can you just can you just check me on what
they'll do is they'll patchy down do extra screening
they're okay with that except about three weeks ago
and they said that they can if you don't have ID they can
on deny you passing through security for
reasons that are not known and not published I'm it's part of whatever
screening that they use and we've tested this
on this was in December you walk into perhaps a gas station by one of those
credit cards for $250 dollars on it immediately go to your car log online
buy an airline ticket under perhaps you're traveling under a pseudonym it's
Jon doe cuz maybe don't wanna get server whatever whatever state you go to you
for whatever reason you can travel under pseudonyms as long as its domestic
I mean we we live in and Union we're not traveling over country borders when we
passed between like Maine New Hampshire and Vermont
and John Doe gone on actually to news Joe I think this Jay Smith who traveled
he on plan important got off in Baltimore Washington Airport went to
supplemental screening did not have ID
and he traveled outweigh and there was no problem and he just wanted to remain
anonymous foreign he was not a threat but there was just no reason for him to
required yeah be required to carry that but that the government help people in
maine your all you have to go through something else green if you don't have
one it is real ID Act driver's licenses
better idea maybe an RFID card that you actually have to be
make contact with something armistead have it being scanned I know the TSA
things would be great
go through on security and just
be scanned that way easier for them but maybe
you don't wanna traffic that way I'm some states have an option for vision
I'm skimming a bar others RFID in Washington state just past 10 the first
laws it says it's a crime to use game others RFID cards from only
but it says here for the purposes of fraud and just after some other legal
purpose
a traveling by the winner pseudonym is not fried there no
there's no monetary fact going on so I just moments now with
I'm as with the was got on this bill
I'm if you do scam summers are fighting cards 10 years few
use it for criminal purposes the lawn onto
on if you'll add on to that for your jail time
okay the last two slides is our fight usage in the UK
and police request for information from one is RFID bus transit cars were way up
and last year and a pair that with the information they get from others cameras
in the UK
they may be able to find out who you are just not your number on your transit
card
and I like the ARF a tracking and hope this was a lot of fun playing this game
and it was voluntary detected you give someone else a few
teen 18 you can alter you could be set your preferences once I
had a theory about why they did that bad on
I this is an interesting way to use RFID this way
this is one of the ways that I worry about RFID d technology could be used as
the cards in China that they have right now the government is installing RFID
readers throughout this big huge city in China
and it's gonna be tracking the movements a citizen's and US companies are helping
deploy this technology but they track your work history
education religion ethnicity police record in your reproductive history
this is the type of information I don't wanna see go in our cards if it does at
least wanna be able to find out what's in from what information
is on my heart about me so on
alright then ends my talk right now and do I have any time for questions
no I doubt okay I'll be around the conference on Friday mid next talk later
so
I'll I'll see you later thank you