Results: RFID and Identity Management in everyday life - ITAS

Case #19: FIFA World Cup Germany Tickets
Case ID # 19, level 1
Title FIFA World Cup Germany Tickets
Researcher Jessica Cornelissen
Timing December 2005 – July 2006
Geography Germany
Setting Leisure
Environment Football stadium
Technology Passive chips incorporated in the access-ticket for the event, chips are supplied by Phillips
(MiFARE Ultralight, ISO 14443, Ultra-high frequency). The software is from CTS Eventim
Costs 0,10 per ticket (total of 3,2 million tickets sold) [5]
Maturity Operational
Owner FIFA World Cup Ticketing Centre
Maintainer German Football Association (DFB), system provider CTS Eventim
Users - Visitors to world cup 2006 matches
- Stadiums participating in the 2006 World Cup
Other actors - FoeBuD [6] > Privacy group
- Datenschutz Zentrum > Data Protection Centre [7]
- Bündnis Aktiver Fußball-Fans (BAFF) > Alliance of active football fans [8]
Case story The technology is applied to combat counterfeiting and to ensure only those with legitimate tickets
can get in. This way it also serves as ‘hooligan prevention/monitoring’. The chips will only be
scanned at the entrance of the stadium. Inside the stadium there will be no scanners [11, 12].
On applying for a ticket one has to provide personal information: name, address, nationality, sex,
date of birth, passport number, e-mail address (optional), telephone number (optional) and,
possible, also the club you are supporting. This information is stored in a database and linked to
the ID-number on the chip [6, 10].
Other applications, like contactless payment, were explored but rejected because of expected
problems over privacy [11].
Germany’s football authorities have been accused of ‘Big Brother tactics’. Privacy groups claim
that the ticketing centre requests for irrelevant information and that it doesn’t make clear what is
done with the information. Furthermore, they claim that opt-in procedures on on-line sales
questionnaires were not clear. [6, 7, 9].
FoeBuD states that the ticket are being sold under false pretexts, like security reasons, and that it
is unfair to insert this kind of technology in an item that much wanted by fans. “What could be
nicer: A top-event with millions of enthusiastic people who would do just about anything for their
most beloved hobby. Add to this a September 11 heralding no end of "threat by terrorism", and you
have all the justification you need for just about any measure to cut down on freedom rights as
long as there is a sticker on it saying "security". And should the World Cup go past without any
assaults you have every justification to afterwards call the whole "security-concept" a success,
RFID in the tickets and all, and silence all the critics with a hearty salute: "Hey, all of you
conspiracy theorists, hundreds of thousands of soccer fans didn't have any problems with RFID!" “
[6]. Also, the German Data Protection Centre states on their website that supervision and security
are two different things. Therefore, introducing technologies under the pretext of enhanced security
cannot be done just like that [7].
Privacy groups have a lot of concern regarding the protection of personal data. However, some of
the assumption they do are false or far-fetched. The FIFA state on the website that personal data
will be processed in compliance with the Data Protection Legislation applicable and that data will
be shared to third parties (like security agencies, stadium operators and shipping providers) only if
necessary [10].
45