Quantcast StorefrontBacktalk » Blog Archive » New Washington State RFID Law A Far Cry From What Assemblyman Wanted
advertisement
advertisement

New Washington State RFID Law A Far Cry From What Assemblyman Wanted

Written by Evan Schuman
March 21st, 2008
Like this story? Share it
To share this story with people in your social network, please click on the network icons below.

Next Tuesday, it’s likely Washington state will have a new RFID law on its books, one that will be the first in the nation to make malicious stealing of data via RFID a crime. But the bill is a far cry from what’s the bill’s assemblyman sponsor had envisioned—and what he says he will still fight to get.

The bill had been pushed by Assemblyman Jeff Morris. The final version of the bill—which Morris said he expects Washington Governor Chris Gregoire to sign into law on Tuesday—makes anyone guilty of a Class C felony if they "intentionally scan another person’s identification device remotely, without that person’s prior knowledge and prior consent, for the purpose of fraud, identity theft or for any other illegal purpose."

The practical impact? If someone is caught and charged for that illegal fraudulent act, this would allow for an additional felony to be added, which might yield a longer sentence.

Morris’ goal was quite different. His original bill was aimed at retailers and would have required prior consent before stores could collect personal data.

What happened? That part of the bill was stripped out in the state senate after what Morris described as extensive retail lobbying efforts. He cited a private meeting he had with an unnamed Wal-Mart VP, where he said the Wal-Mart executive said, "We’re not doing it now but we don’t know what we’ll be doing in the future" and asked that the bill not handcuff the retailer’s future efforts.

Morris vows to try and pass the law again during the next legislative session.

In a related move, the state House of Representatives for New Hampshire this week voted to require manufacturers to apply labels or otherwise notify consumers when the RFID chips are implanted in clothing or other products. The bill also would ban using the chips to track consumers’ movements.


advertisement

Leave a Reply

Newsletter

Quickly catch-up on the latest in E-Commerce and Retail Tech with our free weekly newsletter, with urgent bulletins as news merits.
advertisement

Most Recent Comments

Kill All The Passwords

This article does mention, but does not give enough attention to, the fact that the attacks discussed are only feasible when the encrypted password file can be copied and subjected to an offline attack. The trick is to have authentication performed on a separate, much more strongly secured host - such as an Active Directory Domain Controller, or a Kerberos server, or a NIS+ server, or even using something as banal as an LDAP-over-SSL authentication dialog. In these environments, the odds of the "password file" being stolen and subjected to an offline attack go to near zero, and only online attacks may be carried out by the attacker. With sensible exponential backoff between failed password attempts, lockout after a modest number of failed attempts on a single account, and pattern detection, that minimum 7 character password is quite secure enough. Passwords aren't dead yet for security purposes, and they will be with us for a very long while to come for practical purposes. The trick is to employ them correctly. Read more...
The possibilities you describe are years away from being implemented at best, so for the moment passwords are an ugly reality. Luckily, password managers can easily manage hundreds of passwords of any length. The only thing a user needs to remember is the master password. It seems like an easier task to educate users on how to use password managers rather than implement complex security technology on a global basis. Read more...