|
Archives
Monitoring Employees In A Secure Area
Cincinnati video surveillance company CityWatcher.com now requires employees
to use VeriChip human implantable microchips to enter a secure data center,
Network Administrator Khary Williams told Liz McIntyre. McIntyre, co-author
of “Spychips:
How Major Corporations and Government Plan to Track Your Every Move with RFID,” contacted
CityWatcher after it announced it had integrated the VeriChip VeriGuard product
into its access control system.
The VeriChip is a glass encapsulated RFID tag that is injected into the flesh
of the triceps area of the arm to uniquely number and identify individuals.
The tag can be read through a person’s clothing, silently and invisibly,
by radio waves from a few inches away. The highly controversial device is being
marketed as a way to access secure areas, link to medical records, and serve
as a payment instrument when associated with a credit card.
According to Williams, a local doctor has already implanted two of CityWatcher’s
employees with the VeriChip devices. “I will eventually” receive
an implant, too, he added. In the meantime, Williams accesses the data center
with a VeriChip implant housed in a heart-shaped plastic casing that hangs
from his keychain. He told McIntyre he had no qualms about undergoing the implantation
procedure himself, and said he would receive an implant as soon as time permits.
“
It worries us that a government contractor that specializes in surveillance projects
would be the first to publicly incorporate this technology in the workplace,” said
McIntyre. CityWatcher provides video surveillance, monitoring, and video storage
for government and businesses, with cameras set up on public streets throughout
Cincinnati.
The company hopes the VeriChip will beef up its proximity or “prox” card
security system that controls access to the room where the video footage is stored,
said Gary Retherford of Six Sigma Security, Inc., the company that provided the
VeriChip technology. “The prox card is a system that can be compromised,” said
Retherford, referring to the card’s well-known vulnerability to hackers.
He explained that chipping employees “was a move to increase the layer
of security ... It was attractive because it could be integrated with the existing
system.”
Ironically, implantable tags may not provide CityWatcher with that additional
safety, after all. Security researcher Jonathan Westhues demonstrated how the
VeriChip can be skimmed and cloned by a hacker, who could theoretically duplicate
an individual’s VeriChip implant to access a secure area. Westhues, author
of a chapter titled “Hacking the Prox Card” for Simson Garfinkel’s
recent “RFID: Applications, Security, and Privacy,” said the VeriChip “is
not good for anything” and has absolutely no security.
“
No one I spoke with at Six Sigma Security or at CityWatcher knew that the VeriChip
had been hacked,” McIntyre observed. “They were also surprised to
hear of VeriChip’s downsides as a medical device. It was clear they weren’t
aware of some of the controversy surrounding the implant.”
Although CityWatcher reportedly does not require its employees to take an
implant to keep their jobs, Katherine Albrecht, “Spychips” co-author and
outspoken critic of the VeriChip, says the chipping sets an unsettling precedent. “It’s
wrong to link a person’s paycheck with getting an implant,” she said. “Once
people begin ‘voluntarily’ getting chipped to perform their job duties,
it won’t be long before pressure gets applied to those who refuse.”
Albrecht predicts that news of the security flaws will combine with public
squeamishness to make the VeriChip a hard product to sell, however. “Obviously, nobody
wants their employer coming at them with a giant hypodermic needle. But when
people realize it takes a scalpel and surgery to remove the device if it gets
hacked, they’ll really think twice,” she said. “An implant
is disgusting enough going in, but getting it out again is a bloody mess.”
Archives
|
