Results: RFID and Identity Management in everyday life - ITAS

ferries throughout the whole Netherlands. But already during its first implementation phase in 2005
and 2006, Identity Management issues triggered a national debate.
Owner and maintainer of this RFID environment is Trans Link Systems (TLS), a consortium of the
five largest public transport companies in the Netherlands, representing 80% of the Dutch market.
Travellers are represented by a whole host of organisations, such as two travellers’ interests groups
(Locov and Rover), the Dutch Data Protection Authority (College Bescherming Persoonsgegevens), a
consumer organisation (Consumentenbond) and a privacy watchgroup (Bits of Freedom). Even the
Dutch Parliament got involved and discussed the issues at more than 20 meetings. The Dutch minister
of Transport took position as mediator between the maintainer of this RFID setting and organisations
protecting the interests of its users. Because of the scale of both the system as well as the controversy,
we analysed this case quite thoroughly, using governmental documents, user evaluations from
Translink, publications from privacy organisations and pressure groups, newspaper articles and on line
newsgroups. We got our own OV-chipkaart too, to see how the system works and talk to other
travellers.
The OV-chipkaart contains a passive rewritable RFID chip, which contains a unique number and a
rewritable section to store information on travel time and uploaded value. Users can opt for an
anonymous card or a personalised card. In case of a discount or season ticket a personalised card is
obligatory. Buses and trams have readers placed at the doors, where people check in and out. Now and
then a security officer with a hand-held reader goes through the bus or tram to check on fare dodging.
At the train and subway stations travellers check in at the platform, holding their card near a reader in
order to open a gate. At the start of the project, the total cost were estimated at to be €.1.5 billion of
which a small part would also be paid by local and national governments. A first large pilot was held
in 2005 in the city of Rotterdam and the region South West. About 30.000 test travellers started using
the card in the metro, bus and one rail track from the city to the beach. A second pilot is currently held
in Amsterdam.
In order to get an OV-chipkaart ourselves we needed to fill in an application form requesting many
personal details: name, address, bank account, signature and a copy of our passport. This is quite
surprising, as the card is a debit system and not a credit system. Money can be put on the card through
machines placed at the stations and we did not see why identification was necessary. According to
Translink Systems anonymous card should also be available in time, but these were not offered yet.
Another OV-chipkaart was sent automatically to us by the Dutch Railways, replacing a discount card
we already possessed and for which we already provided personal data. The accompanying letter
proclaimed we were now “prepared for a new way of travelling”. It also stated that, once we waved
our card the first time at the reader, this act would be interpreted as an opt in for the user agreement.
For details on this agreement we were referred to a website. Although this action can be interpreted as
service in order to make the transition more smooth, it is a subtle way to get a personalised card more
accepted than the anonymous card.
On the subway, the OV-Chipkaart worked quite well. When holding our card near the Translink sign,
the reader bleeped, displayed the current value of the card, stated we had checked in and wished us a
pleasant journey. We did however not have to use the card to open the gates. These were left open for
people still using the paper-based tickets. On the buses however many problems occurred. Sometimes
we could not check in. The readers just gave a mysterious code: 707. Most of the bus drivers could not
handle the malfunction, made some jokes about them and offered us a free ride. On other occasions,
the readers did not sufficiently check us out, resulting in a payment for as far the bus would go. One of
our researchers made 40 trips and accounted more than half of the transactions failed. A bus driver,
helping her out on many of these events, called her one night at home to inquire if everything was
sorted out with the card. This account demonstrates the link between the card and the personal
information in the database has not been sufficiently secured yet. Finally, at one occasion we were
checked for fare dodging by a controller with a hand held reader. We then found out the data on the
card also contain our date of birth – yet another bit of identity being managed by the maintainer
without our consent.
11