Creative Destruction, page 3
Too late: I had already clicked through to long lists of annotated RFID transactions associated with the investigation. I had glanced at a few, and one I couldn’t get out of my mind: the tires of a parent’s SUV, recorded by a Wave-N-Go pump at a Mechanicsville gas station. There was no record of a purchase, as though the stop had been for directions or a bio-break.
Clearly, the gas-station chain was providing company data to the feds. Was such surveillance illegal? Unethical? Creepy? Was this different than flight records, which, since 9/11, few expected to remain private?
I was still wrestling with those questions when I noticed: One of the chains providing RFID data to the HSB was Big Bob’s.
~~~
I was more facing my TV than watching it when the last puzzle piece fell into place. Had I been paying attention, I would have simply zapped the commercial. The ad did not even penetrate my consciousness until well into the next segment of sitcom. If my TiVo thought it strange that I backed up to re-screen a commercial, it did not comment.
The ad was for a high-end washing machine. Accompanying a close-up of a red sock atop a mound of pink underwear, the voiceover declared, “Make such tragic accidents a thing of the past.” I froze the frame. It would indeed be great if my red socks and my tighty whities declared themselves to my washer. What was decidedly not great was the sudden epiphany that my socks and undies were likely announcing my presence to every RFID scanner I passed. As in: every big store I entered; every subway turnstile I passed, even if I’d bought my fare card with cash; every Wave-N-Go gas pump ....
Feeling stupid—why had I compartmentalized the RFID-in-clothing problem as purely an in-the-lab issue?—I unearthed my homebrew scanner from its place of exile at the bottom of a desk drawer.
The newer half my wardrobe had RFID tags. My wallet was filled with them.
~~~
If you have not yet joined a currency exchange, you should.
In much simpler times, people worried that newfangled credit cards were an invasion of privacy. There would be centralized records, somewhere, of what you bought when. People who worried about such records—some of them, obviously, Doing Bad Things—would use only cash.
Surely you’ve heard about the supposed nutcases who wear tinfoil-lined hats to hide their thoughts from the aliens. Well, my wallet is now foil-lined. New Euro notes carried embedded RFID tags as long ago as 2005; for several years now, new US currency shared that “honor”—to prevent counterfeiting. Here’s what they don’t tell you: You can be traced by the money in your pocket. Each bill in your wallet was associated with you when you received it at the bank lobby or ATM or in change at a store. It stays associated with you until a bank or store cash register logs its receipt. Tagged bills mean that even buying things with cash is no longer anonymous.
Are you still wondering about currency exchanges? That’s a bunch of folks who meet for the sole purpose of swapping their cash. You can do it out in the countryside somewhere, far from any possible RFID poller, although there are obvious risks to carrying large sums of cash to an isolated rendezvous. A better solution is a shielded room (in technical terms, a “Faraday cage”). Copper window screening works nicely, as long as you remember to cover the floor, ceiling, and door, too. RFID interrogation signals can no more get in than microwaves can get out past the similar mesh embedded in the glass of microwave oven doors.
Click here for plans to build your own currency exchange.
~~~
RFID chips are tiny. RFID tags generally are not, because the antennae must capture enough power to operate the silicon chip. The typical antenna occupies a couple square inches. That means you can find—and disable—the tags. After I calmed down from my red-sock epiphany, that’s just what I did. If my story has made any impression on you, you will, too. I used a scanner to look for them; if you lack access to a scanner, pay close attention to big labels, overlapping fabric, and wide hems. If a garment crinkles, check there between cloth layers.
Shoes are harder. Taking them apart to find the tags that are almost certainly there will probably destroy your footwear. I zapped mine with a focused microwave beam until their chips fried. A bit of shoe polish covered the resulting scorch marks. (You might be able to microwave your shoes, but I don’t recommend it—especially if they have steel shanks.)
You may be asking: Why? Why did I disable the RFID tags in my clothes?
No one had cause to be tracking me. Maybe that was my reason. That the tags helped retailers manage their inventory was no reason for me to be marked like a prospectively wayward cat. I was offended, damn it. Sitting in my newly RFID-free apartment, stewing in high principle, paranoia, and self-righteousness, my thoughts turned to the tires that had led HSB to Mechanicsville. Outside I went.
My car, it turned out, was filled with RFIDs, and not only in its tires and the E-Zpass transponder clipped to the sun visor. Even if I could take the car apart, some pieces were likely unzappable.
Which left what?
I could replace my car with a clunker too old to contain RFIDs. I could, in theory, keep a clunker running with old parts from junk yards. My suspicions were by then in full bloom. I found myself wondering why the NHTSA had suddenly decided a few years earlier that tires had an aging mechanism (Tire Expiration Dates) distinct from tread wear. Was age-related rubber deterioration real, or was it disinformation to get RFID-tagged tires onto every car in the country? Frying an RFID embedded in a tire would soften the surrounding rubber. That couldn’t be good.
You’re overreacting, I had lectured myself. Three-hundred million Americans and almost as many vehicles, evermore tags on each, every day passing within range of, well, I had no idea how many RFID-sensing toll booths and point-of-sale terminals. How could HSB possibly keep up with that data geyser? They would have to concentrate on small subsets already known for some reason, by some conventional investigative means, to merit scrutiny.
Wouldn’t they?
~~~
Perhaps you are enrolled in one or more merchant loyalty programs. Knowing what you buy, and when, and where, has value. That’s why so many stores (but not mom & pop) discontinued coupons in their newspaper ads, but happily provide discounts once you disclose your customer ID. You regularly buy canned soup, so it seems harmless when they tempt you at the checkout with a deal on crackers. The results can be both humorous and off-putting when your favorite bookseller makes recommendations for you extrapolated not only from what you read, but from the gifts you’ve purchased for your quirkiest friends and relatives. It gets downright creepy when your pharmacist speculates from your prescriptions that, for example, you have a likelihood of erectile dysfunction, and mails you a Viagra coupon and the advice you discuss it with your doctor.
Those are trivial examples of data mining. Remember Dad and his disdain for economists? Economists predicted recessions by mining data long before that term came into vogue. Their models, of ever-growing sophistication and ever more voracious appetites for data, hunted for correlations, trends, and clustering. But correlation is different than causation, which is how they predicted nine of the past five recessions. These flawed readings of the economic entrails and commercial tea leaves—they’re almost funny until misinformed government policy ensues.
Data mining is a big deal now in homeland security, and rightly so. Way back in the Cold War, West German federal police broke the infamous Baader Meinhof gang by hunting for prime suspects: single men without cars registered to their names, who paid their apartment rent and utility bills in cash. Estimates vary, but the federal police may have surveilled, by emergent techniques not yet called data mining, up to five percent of the adult West German population.
Data mining can be powerful and productive. It’s a good thing when phone-call patterns give warning of an imminent terrorist strike. But when HSB—and I speak now of former colleagues who are honest and honorable people, who in my mind, notwithstanding my current fugitive status, I consider my friends—detects nine of the next five terrorist attacks?
That’s how you get a Mechanicsville.
~~~
The red-sock incident happened on a Saturday. The following Monday I had a DBA shift, filling in for my still-vacationing colleague. Feeling a bit like Marcel St. Clair, I did a few “Is it still running?” checks of CDW.
Sturgeon’s Law posits that ninety percent of everything is crap. Either Sturgeon was a cockeyed optimist, or he knew nothing about software. The data warehouse required constant babying, reconfiguring, tuning, restarting ... pick your euphemism for “fixing.” Driving the process was a mix of recurrent and ad hoc queries, by which to gauge how well the temperamental software was behaving that day. In the ad hoc category, I queried with a few presumably innocent product RFIDs I’d recently captured with my scanner: tires on a friend’s car, a second cousin’s new penny loafers, a case of beer in the storeroom of the bistro where I had eaten dinner the previous night. I thought nothing of the gaggle of feds clustered across the lab at one of the security administration workstations. Secadmins are a breed onto themselves; it is their nature, like birds, to flock.
I was staring at the screen in frozen disbelief, at a column of time-tagged hits that tracked my buddy’s car around town yesterday, when an HSB guy—the gun-toting, agent type—sauntered over and tapped my shoulder. “A word to the wise, Zach. Checking out your friends and neighbors is not allowed either.”
I went outside for lunch that day, and never came back.
~~~
Which brings us to the end of my cautionary tale. If I am not simply deluding myself, if this blog has a readership beyond seething HSB agents, we may even be, to borrow a phrase from Winston Churchill, at the end of the beginning.
That is all very metaphorical, of course. I am going to be very vague about where, physically, I am. While I am being metaphorical, I will go so far as to admit a return to my roots. I am toiling once again at a mom & pop store. It’s someplace that pays me in cash, and that—like my Mom’s & Dad’s place—still uses those quaint, low-tech devices which, although called “cash registers,” register no information about the currency therein.
To anyone from HSB viewing this: Maybe it’s a grocery. Of course, it could as easily be a dry cleaner, a hotdog stand, or a used-book store. Perhaps it’s none of those.
In short, my hypothetical Dear Reader, I’ve gone underground. The Ten Most Wanted Fugitives list calls me a cyber-terrorist.
HSB now claims I’ve hacked into the transactional databases of American companies. Not so. At worst, I’ve grazed the database of one company, Big Bob’s. In my opinion, that hardly rises to most-wanted status.
HSB would also have you believe I brazenly engaged in a nefarious spying operation from within the bowels of JAB itself. Once again: not so. I’ll admit—I have admitted—to a few peeks. I’ll assert every DBA and sysadmin there does the same. Vigilance in the search for bugs in crappy, overpriced software is no vice.
Why, then, is HSB after me?
It all keeps coming around to Big Bob’s. You’ve already read my after-the-fact reasoning (rationalizing, if you prefer) about the field trips to Big Bob’s that brought me to HSB’s attention. But the friend’s tires that surfaced in the CDW, just before I went to lunch and never returned, were bought at Big Bob’s. By inference, Big Bob’s provided the data to HSB. Who else could tie those specific tires to that friend? Not that Big Bob’s alone could possibly have had enough RFID readers, widely enough dispersed, to have captured the peripatetic course around town of those tires ....
The quicker I am taken into custody, the sooner this narrative, in its many reincarnations and mirror sites on offshore servers, stops. HSB does not want to reveal its plans—devised, I will postulate, with only the best of intentions—to track everyone, everywhere, at any time. They want at all costs to keep secret the clandestine co-opting of Big Bob’s, and countless other retailers, into Big Brother.
I keep remembering that agent’s “friendly” advice. CDW had associated me with my second cousin from across town and the college buddy with whom, at the last minute, I had gone to dinner. My query had been enough to trigger a real-time alert at a secadmin workstation.
Many of you are thinking: HSB has no reason to watch me. I’ve done nothing wrong.
I’m relating this story to make you consider one central fact: I did nothing wrong, either.
~~~
What you do now is your choice. My free advice: Join a currency exchange. Trade shopping lists with your friends. Pay with cash, and patronize stores with old registers. Carry your purchases in a foil-lined shopping bag. Remove those RFID tags that are safely removable.
But if you want to do more ....
I have a new calling, and the spare time to indulge it: very specialized circuit design. I’ve concentrated on gadgets for all things RFID: detecting, spoofing, jamming, and frying. The frequencies used by RFIDs are unlicensed, making my hobby (except perhaps when zapping others’ chips) entirely legal.
What these devices have in common is the long-term effect of their deployment. Widely used, they will degrade databases reliant on RFID-based tracking. If you believe that following your every move and viewing your every purchase should be more difficult than typing a simple query into a government database—if you place any value on your privacy—such degradation is a good thing.
Perhaps you have the skills and equipment to make these devices. Any savvy teen with access to a modern high-school electronics shop can build them. And they offer a productive new use for that old, wireless PDA that hasn’t seen the light of day in months. ;-)
Check back often for updated designs.
I’ve put on indefinite hold my dream that a robot of my design will roll onto Mars or Titan. My robotic aspirations have been repurposed toward a different world: the RFIDsphere. Imagine armies of tiny RFID spoofers and jammers set loose to roam, to mimic codes they encounter, and to inject RFID gremlins throughout their random travels.
How polluted must the data sources for repositories like CDW become before we’re all freed from incessant surveillance?
Herewith two parting comments for my friends at the Homeland Security Bureau, and especially to those of you on the hunt for me. First, you have not heard the last of The Rogue. Second ....
Tag. You’re it.
Survival Instinct
I’m a sucker for a good monster movie.
The mark of a great monster movie, I think, is that you end up rooting for the monster. Is anything more memorable in King Kong than that, “It was beauty killed the beast”? How sad was the death of that lost, misunderstood creature brought to life by Doctor Frankenstein?
Survival Instinct grew from the quest to define a modern-day monster, one that would be simultaneously horrific and tragic.
The story saw several iterations before settling into the version you are about to read. I finalized it while managing a systems-development group which built e-commerce systems. That led, naturally enough, to much of the action taking place on the Internet.
Be afraid ....
PROLOGUE
“Mad Scientist Stops Mad Scientist.”
I wasn’t so much mad as scared spitless, thought Doug Carey, eyeing the headline of the week-old newspaper he could not bring himself to discard. Sheila Brunner wasn’t so much mad as possessed.
Truth seldom lends itself to crisp synopsis.
Accompanying the article was the grainy blowup of a frame from the parking lot security camera. The image of the unfortunate Dr. Brunner, former fellow investigator of neural-interface technology, continued to haunt him. Her eyes squinted furtively, her hair was filthy and matted, her mouth gaped in confusion ... the former scientist was, strange but true, in thrall to a computer virus. The self-adaptive neural net that made possible experimental brain/computer connections had let through the destructive Frankenfools virus. Now little beyond that computer virus’ hysterical Luddite screed ran through what remained of the poor woman’s mind. No wonder she had tried to blow up the nearest biotech company, that just happened to be where he worked.
Used to work, Doug corrected himself. You left.
Jaw clenched in anger at the still unidentified bastard who had unleashed the virus, he grabbed at the newspaper. Plastic fingertips extended fractionally too far rammed into his kitchen table; an electronics-mediated sensation akin to pain shot into his all-natural upper arm. Simple inattention? Emotional turmoil clouding the brain/nervous-system/prosthesis protocols painstakingly developed in endless biofeedback sessions? Despite himself, anger at the loss of self-discipline flared. Now that’s productive, he muttered to himself. He hurled the newspaper into a wastebasket.
Deep breath, Doug.
If investigation of neural interfaces were ever to resume, someone had to figure out how to defeat the kind of viral attack from the Internet that had destroyed Sheila Brunner. It was the task he had assigned himself.
The last incident had nearly gotten him blown to pieces. Why was it that he expected the next event would be so much worse?
CHAPTER 1
The entity was.
It existed in a featureless space; all that distinguished it from the all-encompassing void was an innate reflex that sparked it into sporadic, random action. Often, the activity produced a result that might in some sense be characterized as motion; at other times, the effort invoked an immovable counterforce that left the entity’s situation entirely unchanged.
