You are being tagged

In this comment, I am not going to talk about some online service having geolocation automatically turned on or allows others to put you on a map without your permission – this article is about something that also affects people without any Internet affinity or access to it.

Did it ever happen to you that you just walked into a store and immediately all alarms went off? Did you experience that feeling when all the people in the store start looking at you with concern or fear, thinking you are a thief? Did the security guards suddenly appear close to you out of nowhere asking you to empty your pockets, your bags, take off your jacket and even your shoes?

A reason for this to happen is the increased usage of RFID tags – “Radio-Frequency IDentification“, a technique where some small (hidden) tag can be detected and accessed via radio waves from a few meters distance.

In the last years, more and more stores have switched from the bulky mechanic-magnetic straps to passive RFID tags (sorry about the image quality, it was taken with the phone’s camera).

Those RFIDs are hidden inside the clothes quite well, in order to avoid them being detected and removed easily. In my case, one was in a small pocket (which I never use) of the jeans, and another one in the inside pocket of a jacket and yet another one – unbelievable! – in my sport shoes, below the shoe sole.

The RFID tag in this jacket even has an image upon it showing you what needs to be done with it: cut it off and throw it away.

Getting suspected and embarrassed in a store is not the main problem, as the situation can usually get cleared up sooner or later and they let you go. The future problem is much worse than that.

These RFIDs are reacting to a certain radio frequency by sending the unique identifier of the tag. So, what I’m saying is that each piece of clothing having an RFID tag has a unique number attached to it which is being sent when the right frequency is used. Wear that cloth and you are also tagged.

There are certain layers of security which can be applied to the RFID technology, but none of them is being used in something like clothes because those tags would be too expensive. On the other hand, encryption wouldn’t help the scenario I’m describing now as a unique identification can be done anyways as soon as the RFID tag isn’t sending just random data (which it can’t, it has to have some static data to initiate encryption).

On first sight, it might look unlikely that someone is being tagged, considering that the RFID tags react only to a radio frequency generated by a source situated only max 3 meters away from you. But practically everywhere you can install RFID Gate Readers: in every store, in the entrance of a train and subway stations, at airports, governmental buildings, stores, and so on.

These RFID gate devices contain both a radio transmitter and receiver and have a range of about 2 meters. So, if you happen to be in this range and you forgot to remove the tags from some article, then you can be tagged; as happened in my case, the alarm in a store may go off. It doesn’t beep always though, as different RFID tags use different frequencies.

It’s not only clothes that are being tagged nowadays. Almost everything is: electronics, books, CDs/DVDs, personal hygiene articles and even food articles which are packed. As soon as you buy something and you see in the store that they do use “visible and invisible security measures” look out for these RFID etiquettes and cut them. This may save you some trouble.

Sorin Mustaca
Data Security Expert