Results: RFID and Identity Management in everyday life - ITAS

stored in the Speedpass device and remain outside the Speedpass signal system,
maintaining the confidentiality of that information. [3]
First the developers of Speedpass tried the same technology as in toll roads, i.e. active high
frequency RFID which can be read while driving at high speed. This did not work because of the
large read area of active RFID, making it impossible to distinguish who was using which
dispenser. Addionally, the costs of the active RFID were much higher. Moreover, the passive
RFID gives the customer control over the act of paying: they have to wave it in front of the reader,
as with an active RFID they could be read anytime without noticing.
ID Issue The Speedpass is not just used to pay, but also has a marketing purpose. This is clearly stated in
the “Privacy Policy” and “Terms of use”, which users are assumed to have read and agreed upon
when they subscribe to the pass. For example: “Speedpass and its affiliates may disclose any of
the information that we collect to affiliates and non-affiliated third parties as described below. We
may disclose the information whether you are a current customer or former customer.” Among
parties mentioned are security services, mortgage banking, direct marketing organisations and
“any bidder for all or part of the Speedpass business”. In practice this will mean the identity
“person paying at the pump”, through travel- and consuming profile, could evolve into “potential
valuable customer for a motel, mortgage or groceries” or “a potial link to a criminal network”.
Once a customer uses the Speedpass for the first time, this act is defined as opting in on this
policy. The policy also offers an opt out, but if the information is already passed onto another
organisation, ExxonMobile does not have control or responsibility over it.Additionally, users can
maintain their user profile on line, e.g. view their transactions and receive receipts on line. An IDM
issue arising here is one family member tracing another, for example a suspicious spouse.
Another IDM issue is when the Speedpass is not used by it’s rightful owner. Tags are lost or
stolen. Moreover, they can be copied. Researchers at the Johns Hopkins University and RSA
Laboratories for example succeeded in reading a Speedpass, cracking the code and reproduce
another tag. In order to prevent misuse “Speedpass monitors purchase patterns on Devices, and
looks for unusual behaviour that may signal unauthorized use.” [2] So, comparable to how credit
companies operate, Speedpass analyses transactions in real time for awkward profiles. If for
example an unusual large purchase is made, or purchases occur at awkward locations, the
transactions may be blocked and checked at the rightful owner of the pass. Still, while these
profiling analyses run real time, one could wonder whether these profiles are only used to prevent
fraud.
Still, although the Speedpass system could in principle facilitate all sorts of direct marketing
efforts, tracking of people or fraudes, accounts on it’s current use indicate otherwise. On on line
discussion groups for example, many people express their fear on Big Brother scenario’s, but
none claim to actually encountered privacy invading actions. Most of the discussion treats mainly
evolve around practical matters: on how the system works, if it really saves time or at which gas
stations it can be used.
Sources [1] Speedpass Privacy Policy: https://www.speedpass.com/forms/frmDynPrin.aspx?pId=2 (28
august 2006)
[2] Speedpass Terms of use: https://www.speedpass.com/forms/frmDynPrin.aspx?pId=23 (28
august 2006)
[3] Speedspass Factsheet:
http://www2.exxonmobil.com/corporate/files/corporate/speedpass_fact_
sheet.pdf#search=%22speedpass_fact_sheet%22 (28 august 2006)
[4] Garfinkel, S. “RFID Payments at ExxonMobil” In: Garfinkel, S. & Rosenberg, B. (ed.) RFID.
Applications, Security, and Privacy.
[5] For example: alt.tv.pol-incorrect, misc.activism.progressive or alt.culture.ny-upstate
[6] For example: misc.transport.road
[7] Biba, E. (2005) “Does your Car Key pose a Security Risk?”In PC World 14 February
92