RFID: Security Myths and Realities

With all the disinformation and scare-mongering out there about RFID, it is important to address and debunk the two main types of myths that continue to wrongly taint RFID technology. The two main myths surrounding RFID are that a) hackers and stalkers can access personal information from tags using a portable reader and b) that these tags pose some sort of health or safety risk from electromagnetic frequency emissions.

Hackers & Stalkers

This is one of the most common and fear-inducing myths out there about RFID – that there are chips embedded in your identification, your products and more, and that some baddie will approach you with an RFID reader (since most criminals carry one) and proceed to download personal data about you, then track your movements. This is absolutely false.

The fact is, there’s hardly ever personally-identifiable information on the tag. So an unauthorized person with a handheld reader can only read a number – which means nothing by itself.

If a stalker somehow reads the tag, they could theoretically see the unique number assigned to that person, then use it to track them throughout the day. But don’t get too concerned yet, there is a little problem with this stalker strategy. Since a mobile a reader has a read range limit of around 2 to 5 feet, it would be near impossible to follow a person around and avoid notice. Someone would surely take note of the same person continually following about 2-5 feet behind them. Reality is, if they are able to follow a person that closely, they don’t need an RFID reader. Reading the tag would be a wasted effort and only draw more unwanted attention.

Bottom line: a stalker cannot use RFID to any real advantage, unless they have already accessed the database that the RFID tag number references. And if they’ve gone that far and gained that much unauthorized access, they probably already know the information they’d get from the tag.

The real danger from hacking would be someone hacking the database records that the number is assigned to. Since all that student data exists in the school database today, the technology doesn’t introduce any new risk. If you hack in and already have the students address and approved pick up list, you have everything you need. The tag number isn’t necessary.

Health and Safety

Passive RFID tags operate in the same unregulated unrestricted frequency range used by 2 way radios and most cordless phones in people’s homes. The big difference is that they operate at a much lower power level than those ordinary household items we are all exposed to everyday. If the radio frequency will cause health problems, we need to get rid of our phones and radios long before we rid the world of RFID tags.