Flying 2.0 - Enabling automated air travel by identifying and addressing the challenges of IoT & RFID technology

IoT/RFID Scenario Risk Assessment April 2010

Final Report

Flying 2.0 Enabling automated air travel by identifying and addressing the challenges of IoT & RFID technology

ABOUT ENISA

The European Network and Information Security Agency (ENISA) is an EU agency created to advance the functioning of the internal market. ENISA is a centre of expertise for the European Member States and European institutions in network and information security, giving advice and recommendations and acting as a switchboard for information on good practices. Moreover, the agency facilitates contacts between European institutions, the Member States, and private business and industry actors.

This work takes place in the context of ENISA’s Emerging and Future Risk programme.

CONTACT DETAILS

This report has been edited by Barbara Daskala.

e-mail: RiskManagement@enisa.europa.eu

Internet: http://www.enisa.europa.eu/

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 3

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

LIST OF EXPERTS AND CONTRIBUTORS

This report was produced by the ENISA editor using input and comments from a group selected for their expertise in the subject area and in the areas of assessment (security, privacy, social, legal) including industry and academic experts. It should be noted that group members participate as individuals. This paper should therefore not be taken as representing the views of any company or other organisation, and does not in any way bind group members when dealing with the issues it covers in other contexts. The contributors are listed below in alphabetical order:  Alessandro Bassi, Hitachi Europe SAS, France  Jim Clarke, Researcher, Waterford Institute of Technology, Ireland  France Charles de Couessin, Executive Partner, ID Partners, France  Sotiris Ioannidis, Associate Researcher, Institute of Computer Science, Foundation for Research and Technology (FORTH), Greece  Eleni Kosta, Legal Researcher, K.U.Leuven - Interdisciplinary Centre for Law & ICT (ICRI), Belgium  Paul McCarthy, Research Fellow, Lancaster University, UK  Huang Ming-Yuh, Program Manager, Strategic Information Assurance, The Boeing Company, US  Eurico Neves, CEO, INOVA+ Serviços de Consultadoria em Inovação Tecnológica SA, Portugal  Dennis Nilsson, Consultant at Syncron Japan KK, Tokyo, Japan  Milan Petkovic, Philips Research, The Netherlands  Pawel Rotter, AGH University of Science and Technology in Krakow, Automatics Department, Poland  Markus Tiemann, Human Factors and Cabin/Cargo Operations, AIRBUS Operations, Germany  David Wright, Managing Partner, Trilateral Research & Consulting LLP, UK

In the delivery of technical risk assessment and identification of the implemented controls, we have been assisted by the following risk assessment experts from Ernst & Young, Greece:  Sotiris Papiotis, CISSP, CISA, CBCP, CIA, Executive Director, Advisory Services  Panagiotis Koumousis, Advisory Services, Ernst & Young,  Charalampos Melegos, Advisory Services, Ernst & Young,

In addition, the following ENISA experts participated in the work (in alphabetical order):  Ingo Naumann, ENISA  Panagiotis Saragiotis, ENISA

Flying 2.0 - Enabling automated air travel by identifying and addressing the

4 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

1 EXECUTIVE SUMMARY

ENISA undertook the task to identify and assess emerging and future risks of a particular IoT/RFID scenario, also in the context of ENISA’s role in this specified in EC Communication “Internet of Things – An Action Plan for Europe” *9]. The “Internet of Things” (IoT), sometimes referred to as ubiquitous networking or pervasive computing environments, is a vision where all manufactured things can be network enabled, that is connected to each other via wireless or wired communication networks. The Internet of Things is envisaged to bring many benefits, but it also poses many new challenges and risks.

Thanks to the advancement of ICT technologies, the number of different ordinary devices that increased their capabilities well beyond their original purpose is dramatically rising. These smart devices, which are the bricks needed to realize an IoT are poised to create significant impact on many areas of our

For an Internet of Things / RFID vision

lives, and will be illustrated in detail within this report in a

to realise the benefits envisaged, the

case scenario of air travel. While IoT will inevitably play a

challenges and risks it poses should

major role in improving future air transportation, as it will

be identified and addressed in a

in many other areas as well, there are critical issues to be

proactive way. These risks do not

identified and considered in depth. Smaller form factor and

always have to do with the

portability encourages mobility, which leads to frequent

technology per se but with the way

interaction between devices, sensors, and network we use it. infrastructures. The movement of travellers, airport/airline personnel, and luggage creates an increasing amount of continuous interaction between devices. As the result of these interactions, significant amounts of sensitive information will be generated and shared. The aspects of system security, safety, data sensitivity, usage and management all require further investigation and require addressing in any implementation of IoT environments.

For the purposes of this work, an expert group was assembled to carry out a risk assessment on a complex scenario involving Internet of Things (IoT) / Radio Frequency IDentification (RFID) technologies in future air travel. Amongst the technologies, applications and devices considered in this scenario, in addition to RFID, are smart phones, netbooks and location-based services (LBS). The power of these technologies is greatly leveraged by their convergence and interoperability. The air travel scenario was selected to illustrate the convergence of these IoT technologies and the issues that arise as a result of this convergence and interoperability.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 5

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

This report contains the result of this work. The risk assessment involved extensive detailed identification This report explains how potentially this and measurement of the vulnerabilities and emerging technology can be used in an air travel threats for the entire scenario. Moreover, the report scenario; in the scenario we look at the also includes appropriate recommendations to address benefits of this technology and the risks identified. environment, particularly in future air

travel, and we identify the major

The intended audience of this report is: security risks. We also cover the privacy,  social and legal implications. Finally, we European Commission and European policymakers,

make concrete recommendations on

to assist them on setting research policy (to develop

how to address the risks, so as to

technologies that mitigate risks) and to assist them maximise the benefits. in deciding on appropriate policy and economic incentives, legislative measures, awareness-raising initiatives, etc. vis-à-vis IoT/RFID technologies and applications; and in particular, on air travel;  Industry, to encourage them to secure their technologies and services, to make transparent to citizen-consumers their purposes and practices in collecting and processing personal data and to identify any third parties with whom they share such data;  Air transport stakeholders, such as airports, Airport Council International (ACI) and IATA;  Individuals or citizens, to enable them to evaluate the costs, risks and benefits of using the consumer version of these applications.

1.1 RECOMMENDATIONS

In order to mitigate the risks identified, appropriate recommendations were presented in the report. The recommendations were made for the various stakeholders, including technology and policy, research, legal and European Commission. The following contains a summary of the top recommendations identified within the report. Further details on the recommendations can be found in Chapter 6.

Rethink existing business structures and introduce new business models. It is recommended that air transportation businesses and agencies (e.g. airlines, airports, air cargos/logistics, and government aviation security agencies) proactively plan, design and stay alert on the introduction of new business models.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

6 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

User-friendliness of devices and procedures / be inclusive. The usability of the smart technical applications / devices has to be considered thoroughly. Processes have to be clear and comprehensible, and user interfaces have to be designed in such a way that the corresponding systems will be easy to use by their target groups.

Data protection and privacy. It is recommended to carry out research to examine the issues in relation to IoT deployments and to further extend security and privacy solutions.

Usability. It is recommended to investigate the issues related to usability of security and privacy technologies, and consequently research and development in the related technical fields including human-device interfaces and assisted privacy policy (consent) specification and management.

Managing trust. In a future IoT environment, trust should be a central consideration; an enterprise should identify and understand its own trust framework in order to be able to deal with the IoT challenges. It is also recommended to focus particularly on the appropriateness and the compliance aspects of trust policies into the IoT applications.

Multi-modal person authentication. It is recommended to further investigate and develop biometric procedures for person authentication.

Proposing standards of light cryptography protocols. It is recommended to set up light cryptography standards and give some time to the scientific community to test them before wide implementation.

Support for Users. It is recommended that sufficient support is provided to data subjects so that they get adequate information relating to the processing of their personal data and they can better exercise their rights.

Placing a high value on information and data. It is recommended that the entities that process personal data, including any governmental or commercial entity, such as electronic communications providers, road infrastructure providers, airline companies or any other entity in the air transport sector, shall value highly the security of the personal data of the data subjects and shall take all the necessary technical and organisational measures to ensure it.

Harmonisation of data collection by airport shops. It is recommended that there be further harmonisation of the current practice and efforts be made to raise awareness among travellers as to the collection and processing of data when purchasing items from shops.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 7

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Enforcement and application of the European regulatory framework. It is recommended that the Commission prepare guidelines on the better enforcement and application of the European regulatory framework, especially in view of the challenges posed by technological developments.

Alignment of research with industrial and societal needs while promoting the participation of

industry, and in particular SMEs in research activities as FP7. It is recommended that the Commission reinforce pilot activities in the line of the present CIP ICT-PSP programme with more ambitious targets and measures for participation of SMEs.

Ethical limits research. It is recommended that the Commission encourage more (and better) research at EU level on the ethical limits of private data capture and circulation, and on the societal implications of developments in this regard, e.g. under the Science and Society programme of FP7.

Need for impact assessment and trials of new technologies before deployment: privacy and security

by design. To avoid rushed decisions and roll out of technologies that might create more security problems then they fix, it is recommended that any decision on the introduction of new technologies and new procedures should be taken only after a privacy and technology impact assessment and by a joint panel with representatives comprising all stakeholders (industry, civil society organisations, legislators, technology experts, health experts, data protection authorities etc.), which are truly tested and adopted jointly by all Member States. It is recommended that the European Commission appropriately endorse and steer such a process.

1.2 TOP RISKS

The most important risks discussed in this report are the following:

Failure of reservation, check-in and boarding procedures – Procedural / operational failures and other organisational interruptions; passengers and airlines may be unable to perform automated reservation, check-in, and boarding procedures due to procedural or operational errors, ill-designed procedures, introduction of erroneous data or even resource shortages from unexpected interruptions such as industrial action (e.g. strikes etc.). For more information, please refer to [R1].

Problems in issuing / controlling electronic visas – The risk of states’ inability to issue and control the usage of electronic visas arises from system failures, procedural incompatibility, equipment failures, cyber attacks, identity theft or usage of erroneous data. As a result, citizens/passengers are unable to obtain an electronic visa for their travel. For more information, please refer to [R2].

Flying 2.0 - Enabling automated air travel by identifying and addressing the

8 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Loss / violation of citizen/passenger privacy – The natural characteristic of IoT environment is the prevalence of devices, sensors, readers, and applications which have the potential to collect a multiplicity of data types of individuals as they move through such environments. Many citizen data will be generated and collected for example, as well as other forms such as location, purchasing habits, as well as other preferences stored for ease of use in systems. This leads to concerns over the potential compromising of citizen’s privacy via collecting/surveillance/profiting of traveller’s activity. For more information, please refer to [R6].

Compromise and abuse of state-owned citizen/passenger databases – States provide and collect citizen/passenger data throughout the air transport process; these data may also detail citizens’ mobility patterns and as such open the possibilities for abuses through practices such as profiling, unwarranted monitoring or data in governmental databases being compromised due to accidental loss, fraud or other illicit or criminal activity. Of particular concern here would be corruption or unavailability of the state-owned citizen air transportation databases. Moreover, any inaccuracies of data may mean that citizens may be inaccurately identified as ‘suspicious’ (false positives), while perpetrators may not be appropriately detected (false negatives). For more information, please refer to [R7].

Repurposing of data / mission creep – The risk here is that data will be used for purposes in addition or other to those originally specified. Repurposing of data can be in the cards even before data collection begins, e.g., law enforcement authorities or intelligence agencies may seek access to data collected by others for specified purposes. This is not just in relation to the violation of individual rights to privacy but also may impact on wider social and public acceptance. For more information, please refer to [R8].

Health process-related concerns – It is expected that the “Internet of Things” will create significant impact to future delivery of healthcare. However, high dependability on the IoT technologies in e- Health creates significant security and privacy risks; particularly with respect to patient identification and reliability of collected information. For more information, please refer to [R9].

User frustration and low user acceptance – The sometimes complex procedures and sophisticated devices may overwhelm users, the travellers that are not IT friendly or even airport / airlines personnel can be potentially included in this category of persons. For more information, please refer to [R11].

Aggressive profiling and social sorting leading to social exclusion – In a highly interconnected environment as IoT is, the collection of data and profiling are both facts and not necessarily negative per se. However, excessive data collection and profiling, will inevitably lead to social sorting practices for commercial or other purposes, leading to exclusion of people from accessing services. Like

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 9

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

repurposing of data and mission creep, social sorting in an increasing temptation with increasing data collection. For more information, please refer to [R12].

Legislation lagging behind rapid technological advancements – The rapid advance of technology is at variance with the slower pace of the legislative processes, which may lead to serious legal gaps in a future environment of Internet of Things, particularly in the context of air travel. These gaps pose a big challenge to Member States and the European Institutions to tackle, since inadequate legal protection may have severe negative impacts on the everyday lives of European citizens. For more information, please refer to [R17].

Non-compliance with data protection legislation – Currently there is a strong data protection legislative framework in place, which is likely to be adapted by 2015 to better deal with the challenges posed by the technological developments, such as the Internet of Things. Nevertheless, there are certain concerns and risks relating to the processing of personal data. Some of them arise from the challenge of assuring compliance with the legislation, since as we experience every day it is not something easily achieved. For more information, please refer to [R18].

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 11

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

2 INTRODUCTION

2.1 BACKGROUND

The “Internet of Things” (IoT), sometimes referred to as ubiquitous networking or pervasive computing environments, is a vision where all manufactured things can be network enabled, that is connected to each other via wireless or wired communication networks. While there is no single definition for the Internet of Things, a commonly accepted one is the ITU-T definition from 2005, arguing that the development of item identifications, sensor technologies and the ability to interact with the environment will create an Internet of Things. The Internet of Things is envisaged to bring many benefits, but it also poses many new challenges and risks.

In view of this, ENISA undertook the task to identify and assess emerging and future risks of a particular IoT/RFID scenario, also in the context of ENISA’s role in this specified in EC Communication “Internet of Things – An Action Plan for Europe” *9].

This report contains the result of an extensive risk assessment effort on a comprehensive scenario involving IoT and RFID usage in the context of air travel. The assessment involved extensive detailed identification and measurement of the vulnerabilities and emerging threats for the entire scenario. Moreover, the report also includes appropriate recommendations to address the risks identified.

2.2 OPPORTUNITIES OF IOT/RFID IN THE FUTURE – A CASE SCENARIO

The Conferences “On RFID: The Next Step to the Internet of Things” held in Lisbon during the th Portuguese Presidency on 15-16 November 2007, and subsequently the Conference on “The Internet of Things Europe 2009: Emerging Technologies for the Future” in May 2009 concluded with a consensus for Europe to analyse, assess and develop common strategies for optimising the shift of RFID technology into the “Internet of Things”, whilst safeguarding sensitive information and protecting the privacy of individuals.

In parallel, thanks to the advancement of ICT technologies, the number of different ordinary devices that increased their capabilities well beyond their original purpose is dramatically rising. These smart devices, which are the bricks needed to realize an “Internet of Things” (IoT) are poised to create significant impact on many areas of our lives, and will in this be document be illustrated by the case

Flying 2.0 - Enabling automated air travel by identifying and addressing the

12 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

scenario of air travel. It is clear that Airlines already improved significantly their operational efficiency by utilising Internet check-in, electronic boarding passes, RFID-enabled luggage handling, as well as eenabled airport check-in and boarding. The adoption and deployment of smart devices is bound to improve their efficiency even further. Similarly, border control and airport security agencies can make use of these technologies to achieve a more accurate and efficient screening process. From the passengers’ perspective, improved convenience comes from reducing or even eliminating the need to carry and manage various pieces of documents, certificates and other sensitive assets.

While IoT will inevitably play a major role in improving future air transportation, as it will in many other areas as well, there are critical issues to be identified and considered in depth. Smaller form factor and portability encourages mobility, which leads to frequent interaction between devices, sensors, and network infrastructures. The movement of travellers, airport/airline personnel, and luggage creates an increasing amount of continuous interaction between devices. As the result of these interactions, significant amounts of sensitive information will be generated and shared. The aspects of system security, safety, data sensitivity, usage and management all require further investigation and require addressing in any implementation of IoT environments.

Moreover, the overall system vulnerability landscape is not the mere sum of the vulnerabilities of single devices. As different components start to interact, seemingly minor vulnerabilities of one (e.g. malware on a smart phone), could potentially trigger a major risk of another (e.g. avionic system safety) and amplify the overall risk level. Because of this, new “emerging” vulnerabilities are created (i.e. A + B = A + B + Emerging Risks). The future air transportation processes must therefore address these compound emerging risks, as well as be in a position to predict them and manage them effectively in robust risk management procedures.

2.3 WHY AN IOT/RFID AIR TRAVEL SCENARIO?

In the context of our work in WPK3.1 , identification of emerging and future risks, we carried out an exhaustive risk assessment on a complex scenario involving Internet of Things / Radio Frequency IDentification (RFID) technologies in future air travel. Given that we are already seeing the introduction and use of smart technologies and applications in air travel (e.g., RFID-enabled passports, electronic boarding passes sent using SMS and displayed using cell phones, etc.), we consider this as a representative, realistic yet emerging, showcase scenario within which we can identify and highlight important risks and challenges posed by IoT technologies. Amongst the technologies, applications and devices considered in this scenario, in addition to RFID, are smart phones, netbooks and locationbased services (LBS). The power of these technologies is greatly leveraged by their convergence and

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 13

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

interoperability. The air travel scenario was selected to illustrate the convergence of these IoT technologies and the issues that arise as a result of this convergence and interoperability.

2.4 TARGET AUDIENCE

The intended audiences of this report are:  The European Commission, EU Institutions and EU Agencies (e.g. EASA), to assist them on setting research policy (to develop technologies that mitigate risks) and to assist them in deciding on appropriate policy and economic incentives, legislative measures, awareness-raising initiatives, etc. vis-à-vis IoT/RFID technologies and applications; in particular, on air travel;  Industry, to encourage them to secure their technologies and services, to make transparent to citizen-consumers their purposes and practices in collecting and processing personal data and to identify any third parties with whom they share such data;  Air transport stakeholders, such as airports Airport Council International (ACI) and IATA;  Shop owners and vendors who operate in airports;  Individuals or citizens, to enable them to evaluate the costs, risks and benefits of using the consumer version of these applications.

2.5 SCOPE AND OVERVIEW OF THE SCENARIO

This scenario is explorative and is set in the future, approximately five years from now in the year 2015. It follows three passengers of different citizenships (EU, US, Japan) flying from European airports. The scenario depicts emerging automated procedures typically used in normal air travel, such as check-in and boarding. Different criteria have been used to select the passengers starring in the scenario, namely:  Nationality: Richard is a US citizen, Elena is Spanish and Akira is Japanese  Age: Richard, Elena and Akira, belong to different age groups: 52, 39 and 20 years old respectively.  Health: Richard is a diabetic and has serious heart problems, Elena is healthy overall, but has an allergy condition and Akira is healthy  IT “literacy”: While Richard and Akira are familiar with technology; Elena faces some basic problems with the use of technology and finds it quite overwhelming following the air travel procedures using smart devices.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

14 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

 Language skills: Elena does not speak German and has difficulties in communicating even in English. The others two can both speak English and Richard German as well.

The scenario takes into account current work being carried out by Airport Council International (ACI) and the Simplifying Passenger Travel (SPT), an international interest group comprising of representatives from governments, security agencies, professional organisations, technology vendors, airports and airlines, which is driven by the International Air Transport Association (IATA), the international syndicate of airlines. The scenario considers the IATA-SPT Ideal Process Flow (IPF) [see Figure 1] and shows how new technologies such as smart phones, RFID and LBS can contribute to improving the flow of passengers through airports and onto the aircraft and thereby cutting costs for airlines, airports and other stakeholders while, at the same time, improving security.

Figure 1 – The technology response to the growing demand from airlines and airports for passenger automation.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 15

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

In the context of the current and emerging procedures for handling passengers, the scenario also examines how the Internet of Things could be a pervasive element within future air transportation from the perspectives of industry and consumer stakeholders.

The scenario tracks and is divided into several phases based on the air travel process and involves the following:

On the day of travel, there are multiple ways of getting to the airport – personal vehicle, buses, taxis, trains and shuttles. Smart IoT devices interact with various established services in helping passengers get to the airport safely, on time and cost effectively. These services can include on-line selection of travel options based on current position, traffic road conditions, flight schedules and updates, carpools and airport parking assistance.

As a result of IATA’s Simplifying the Business (StB) program , most carriers (99 per cent) have now adopted electronic ticketing (e-ticketing) measures, to replace costly paper boarding passes. Passengers are invited to check-in from home or at special airport counters and kiosks using electronic ticket codes. While carriers and airports are planning to implement more and more efficient selfservice kiosks, there is still a long way to go to fully implement a process based entirely on smart devices.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

16 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Within the scenario, accompanying friends and family members are limited to the check-in zone of the airport. Only passengers and necessary personnel (e.g. crew members, airline agents, service personnel, restaurant and shop clerks) are allowed to enter the restricted zone for security reasons. Measures for the access control to the restricted zone are being accomplished in two steps:

 Identification and authentication: Individuals are identified by comparing their physical traits (face, height, age, etc.) with those documented on a valid official identification document (e.g. passport, national ID card, crew pass, personnel pass).  Authorisation: This is the process of determining whether an authenticated entity is allowed to enter the restricted zone. For passengers, it is done by means of a boarding pass, valid for a flight in the current timeframe. The data on the boarding pass are communicated through 2D barcodes displayed on smart devices, printed on a paper strip or transmitted by near field communication (NFC) and verified by the departure control system of the airline. For the crew and service personnel, authorisation is granted based on a valid crew or airport personnel pass. If they contain a photo, valid passes often also support authentication. Passengers travelling within the Schengen area are normally exempt from passport checkings and visas required of non-Europeans. There is limited or no border control within the Schengen area.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 17

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

A number of fast-track programs have enabled automated border controls based on e-passports. However, there is currently no standard technology used for automatic gates. Most of the systems are based on either fingerprints, with a prior enrolment in a government database, or face recognition based on the match between the passenger and the digital picture in her passport. Furthermore, some airports (e.g., London Heathrow) give travellers the option of using special gates that implement biometric checks (iris scans). Another example can be found in Amsterdam Schiphol airport, where travellers can register for the Privium service program. This is designed for frequent flyers who wish to travel without unnecessary delays. Within Privium, an iris scan is stored on the Privium card . The traveller submits to an iris scan that is compared to the one on the card for a quick pass through the security checks. The iris scan even works when wearing glasses or contact lenses.

The scenario highlights the automatic authentication of passengers by means of their biometric features (e.g., fingerprints and facial image of citizens ) stored in their passport as part of EU border control. The scenario does not enter into much detail about this authentication process.

The implementation of an EU passenger name record (PNR) program is scheduled to enter into force from 2010, which will enable travellers to fill in Electronic Travel Authorisation (ETA) forms online 48 hours before departure. The scenario assumes that this has taken place but refers to generic systems instead of specific named ones thus far mentioned in EU documents. We likewise make assumptions that the characteristics of this system will mirror those outlined currently, with the caveat that we accept there might changes in the manner and method of its implementation. This is particularly dependent on currently ongoing consultations between the European Parliament and the Commission on these systems. At many airports, a security check comes immediately after access to the restricted zone and before the passport and immigration control. The scenario depicts performance of security checks in smart corridors equipped with metal detectors, explosive detection systems (EDS) and liquids and gels (LAG) detectors to identify prohibited items such as weapons, liquids and explosives.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

18 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

sought to turn this time gap into an advantage. Duty-free shops, kiosks, restaurants and information services compete to attract travellers’ attention and their intention to buy. Passengers often are interested in buying souvenirs, food, entertainment, network access and other services, while airports are increasingly happy to accommodate increased consumer spending as reflected in the design of airport retail space. The interesting challenge here is matching consumers to suppliers effectively (finding the right customer as well as the right product), efficiently (since time is relatively limited) and unobtrusively (not an open market). IoT smart devices could play a major role enabling the future of this environment. They also have the capability to unobtrusively provide direction-related assistance, e.g. for locating gates, stores, restrooms, kiosks, police desks, wheel chair stations, access gates for people with reduced mobility (PRM) and airline service desks.

Airport security may also monitor abnormal behaviour of passengers, e.g. lingering around in sensitive areas using localisation-enabled smart devices. They may also wish to identify potential emergency situations, e.g. of disabled passengers needing help, by detecting people not having moved for an excessive time.

Smart boarding

By smart boarding, we mean that the passenger is already identified based on the link established between the check-in system and the ultimate boarding control via the departure control system (DCS)

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 19

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

of the airline. The concept is quite straightforward: the passenger has completed the check-in using any technology – e.g. Internet printing of the boarding pass, PDA validation of an electronic code, NFC interaction with a sensor.

Several airlines have already implemented such a system to speed up boarding procedures. This requires a prior negotiation with data protection authorities, as private companies are not allowed to access the biometric data stored in the e-enabled passports. For these reasons, these airlines have launched proprietary systems, as Air France has done for flights between Paris and Amsterdam 9,10 Schiphol .

Combined with the increasing prevalence of “Internet in the air” services, smart devices will have significant impact to both airlines and passengers. Broadband wireless communication will enable the download of flight and in-flight entertainment (IFE) data for travellers. During their flights, passengers will have access to the Internet via their netbooks, smart phones or the IFE screen. If desired, movies can be uploaded before the aircraft departs.

Upon arrival, passengers claim their luggage and proceed to local transportation to head toward their final destinations. IoT and smart devices are expected to further facilitate this process and, in particular, enhance services related for example with assistance on local arrangements for visitors. Also, from the local perspective, the arrival of a new passenger creates business opportunities (e.g., ground transportation, lodging or tourist services); is envisaged that IoT devices will facilitate the the exploitation of such opportunities.

For passengers transferring to another flight, IoT devices can assist in providing connection and flight information and locating the correct gate. Therefore, another round of “waiting to board” scenarios is

Flying 2.0 - Enabling automated air travel by identifying and addressing the

20 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

played out in the gateway airport. In particular, for passengers who miss their connection, IoT devices can assist in flight re-booking, wherever required (some airlines, e.g. Delta airlines, currently provide automatic re-booking) and, if necessary, lay-over lodging and hotel transportation. Some airlines have systems already in place that re-book delayed passengers onto the next available flight and, in the future, passengers will receive the up-to-date information on rebooked flights automatically on their devices when they arrive at the airport.

After leaving the aircraft, at the arrival gate, and particularly in big airports, passengers may be offered additional guidance if needed, through the arrival process and to the final destination by personal electronic devices, as well as airport infrastructure such as information kiosks and guidance systems. Moreover, booking applications may be available for taxis, public transportation or further travelrelated services. Data may be exchanged between flight information systems, the passengers’ personal devices and those services in order to update schedules and to ensure seamless and comfortable transportation.

2.6 WHAT’S OUT OF SCOPE

The following fall outside the scenario’s scope:  National security issues were not considered: as ENISA worked in first pillar activities of EU at the time when this project was first conceived, it was not possible to enter into issues of national security that fell within the third pillar. For this reason, border control issues fall out of the scope of this assessment. Any border control mentioned in the scenario is only for completion purposes, as this is an inherent part of the air travel process, and we want to keep the scenario realistic.  The focus is mainly on passengers. Due to limited time and resources, the scenario does not consider in detail security personnel, airline crew and other airport personnel, who may have different access requirements.  Aircraft security and general aviation maintenance, repair and overhaul (MRO) procedures are not considered, as they would considerably increase the complexity of the scenario.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 21

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

3 CAUTIONARY TALES – FLYING 2.0 – A ‘SMART’ IOT/RFID AIR TRAVEL SCENARIO

ENISA convened a group of independent experts to develop and analyse a scenario, the context of which was the use of new smart technologies, notably IoT technologies, in air travel. Once the scenario was reasonably stable (it went through several iterations), the group then analysed the scenario using ENISA’s methodology, in particular to identify assets, vulnerabilities, threats, risks and remedial actions as well as eventually recommendations to policy-makers and other stakeholders.

Thus, the scenario is the foundation on which everything else is built. The scenario developed by the group can be found in Annex II.

This section presents three cautionary tales, based on the somewhat longer scenario script. The cautionary tales are in two parts. The text in the right-hand column presents a streamlined scenario script, while the left-hand column provides some commentary, notably on possible risks arising from the actions taking place in the scenario script. Also in the left-hand column are some [R xx, where xx represents a number] which refers to the specific risks identified in section 5.2 of this document.

A – RICHARD

Introducing Richard… and Richard is a 52-year-old US citizen who has been working in his gadgets: a pace-maker, a Frankfurt and now is flying back to Atlanta, with German Air (GA), sensor implant and a smart for his vacation. He has had two heart surgeries over the years and phone carries a pace-maker. He also has a chronic diabetes condition for which his doctor has implanted an in-body blood sugar level monitoring sensor. The monitoring system can communicate with his doctor in case of an emergency using Richard’s smart phone as a

He depends on the reliability

gateway. This system is also capable of announcing itself to the

of his technologies and the

surrounding environment and other devices (e.g., body scanners or

communications’

smart corridors) in case they might disrupt his pacemaker or body

infrastructure [R9], [R13]

area network.

He similarly depends on the As a non-EU citizen resident in Germany, Richard has enrolled in the security of government registered traveller (RT) program at the German Ministry of Interior

Flying 2.0 - Enabling automated air travel by identifying and addressing the

22 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

databases offices in Frankfurt.

… and of industry databases He has recently bought a new smart phone with NFC functionality in and service providers [R10], order to use a personal healthcare service while he is on the move. [R9] The smart phone is able to collect data from his implanted blood sugar level sensor and forward its measurements to a “steady-sugarlevel” diabetes service to which Richard has subscribed. The service monitors Richard’s blood glucose level and provides him advice on his diet and activity.

Richard’s details are on his Richard, who is an “Elite frequent flyer” member of his airline’s airline’s database, so he program, confirmed his flight and selected his seat 24 hours in depends on its security and advance with his smart phone. To do this, he logged in with his it not being shared without frequent flyer number and his PIN code and then selected the online valid reasons, but check-in menu. This check-in menu is accessible via both computer government agencies have and personal digital assistant (PDA). As a result, he received and such access [R6] stored in his smart device a token for his check-in data, as well as information and alerts on his calendar. This token is used as his boarding pass. When registering as a frequent flyer member, Richard registered his fingerprints to the airline. When the token is issued, it is encoded with his fingerprints to prevent someone else from using his token.

The RFID tags could become During the check-in process, Richard asked for a luggage service, detached from the luggage, which picks up passengers’ luggage from their homes. When the either by accident or on service personnel arrive at his house, Richard communicates his purpose. Richard could also boarding pass data from his smart phone to their mobile device lose his smart phone and, if which include RFID printers. The driver prints RFID-enabled luggage so, would lose the RFID tag’s tags and attaches them to Richard’s luggage. These tags contain number [R5]. Richard’s passenger and flight data as well as other relevant data such as weight, priority handling and insurance. Richard is also reminded to point his smart phone at the tags to record their number, and then the driver takes the luggage to the airport. This enables Richard to get a receipt, stored in his smart phone, of the luggage tags, to be on the safe side.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 23

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

It is not clear who is Throughout the travel, the RFID tags will be read by scanners at retaining the data on the tag various locations in the luggage transportation chain, and the data and what they do with it. they contain will be stored on the relevant system.

[R6, R7]

Richard has no insight about Richard has also filled in, 24 hours in advance, the passenger name what happens to his PNR, record (PNR) form at the German Airlines website, where he who gets the data and what provided personal information including his name, date of birth, they do with it [R7, R10]. nationality and passport issuance data. These data were then processed and validated by the German Passenger Information Unit (PIU) and then forwarded to the US Department of Homeland Security which then further disperses the data to other US agencies.

Richard does not consider As Richard has no luggage to carry, he decides to travel to the any risks arising from third airport using Diamond Airport Shuttle Express. He is a subscriber to party access to his smart a web-based travel service called “WhereToGo”, which books the phone [R14, R15]. shuttle for him based on his departure time. Acting like a secretary, WhereToGo places the shuttle reservation, pick-up time and fare information into the electronic calendar on Richard’s smart phone.

Everything works smoothly German Air announces an unexpected three-hour delay in the as long as Richard does not departure of Richard’s flight. WhereToGo immediately re-books the lose his smart phone. shuttle, updates his calendar and sends Richard a voice mail alert. Unperturbed, Richard uses the extra time to respond to e-mails and review some reports. As his pick-up time finally approaches, WhereToGo sends him a reminder about where he has to go to meet the shuttle.

The shuttle service uses car-to-roadside communication to continuously update its route and time planning to ensure on-time arrival at each pickup location and at the airport. After picking up Richard, the shuttle bus receives information from roadside units (RSU) at an intersection ahead about a car accident blocking traffic. The shuttle bus takes an alternative route to avoid the traffic accident and they arrive at the airport on time.

Before arrival, the shuttle driver requests payment and Richard pays

Flying 2.0 - Enabling automated air travel by identifying and addressing the

24 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

the meter plus tip using his smart phone, which has an e-cash purse application (among many others).

Richard’s identity does not have to be revealed to make

a payment.

If someone had stolen Upon arrival in the airport, Richard checks his smart phone for the Richard’s smart phone [R15], latest flight status information. He uses his smart phone with the that someone could get past received token during check-in in combination with the smart this first security check. phone’s near field communications (NFC) capability to gain access to Fortunately, there is no the restricted zone. He also has to put his finger on a reader which failure in the process of reads his fingerprint and confirms that the token is issued to him. If checking in and boarding his phone were to be stolen, the token would not be usable without [R1] his fingerprints. The scanner is linked to the departure control system (DCS), which has the data on Richard’s travel on the German Air flight to Atlanta. He is allowed to enter the restricted zone.

The choice of a fingerprint or Since Richard is leaving the Schengen area, he needs to go through iris scanner is meaningless the automated passport control. He proceeds to a border control for some disabled or older booth and places his passport near the reader to activate the passengers who may not be authentication process. The passport reader verifies his passport. able to confirm their identity Richard has to use a fingerprint or iris scanner which confirms him as by either means [R17]. the rightful owner of the passport based on biometrics stored in it. Legislation lags technology He is then subjected to a full body scan, which he clears after developments such as full officials see that his pacemaker and implant are non-threatening. body scanning [R17]. (Not all airports are using full body scans yet, partly because of the cost and partly because of a lack of legislative authorisation.) Access to the security control zone is authorised after the automated passport/immigration control system accesses the Passenger Information Unit (PIU) at the German Ministry of the Interior, which delivers an electronic travel authorisation (ETA), based on the

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 25

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

clearing of his PNR data.

By agreeing to this service, Richard can then enjoy various airport facilities, such as connecting Richard potentially exposes to the GA Elite Frequent Flyer free Wi-Fi network. When he buys himself to a lot of location- goods from duty free shops, he confirms his flight by communicating based spam [R18]. So far, it his token through NFC. While Richard is browsing, a location-based hasn’t been a problem. service (LBS) identifies his presence to a neighbouring duty-free shop or, at least, the presence of someone who has indicated his interest in certain products. Based on his LBS’ preferences, the shop automatically transmits a message to Richard’s smart phone, recommending that he checks out its offer on silk scarves. Richard visits the store and buys two scarves for Helen, his wife.

Richard believes that his Richard feels hungry. He goes to the “Food Corner” to grab a electronic purchase does not sandwich. His smart phone has an application which enables Richard leave any digital traces of to detect RFID-labelled products which are compatible with his personal data (which could restricted diet. As he pays for the item using his smart phone’s eresult in identity theft purse function again, he receives an alert from German Air calling [R14])… and he may be right him to his boarding gate. A few minutes later, he retrieves the in this case check-in token again and authenticates himself at the gate as he did at passport control.

…but on-board, he is less

Richard boards his German Air plane which is equipped for

sure. Perhaps the airline

“physically challenged passengers”. The aircraft has special seats

monitors his health status

embedded with pressure and temperature sensors, which

too, linking that data with

unobtrusively monitor passengers for early warnings such as lack of

the data they already have

movement or agitated movement during long flights. The aircraft about him…[R9]. also has an onboard wireless network which allows Richard to transmit signals from his body area network to terrestrial networks and on to his health subscription service which can detect any early

nor can he be sure about

signs of health problems.

whether his communications

are monitored [R18].

The aircraft’s satellite communications service, although expensive, allows Richard to connect with the Internet and to check his e-mails.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

26 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Richard’s service provider Since Helen, Richard’s wife, said she would collect him from the also knows where he is and, airport upon arrival, Richard ensures his smart phone’s position unbeknownst to him, could determination function is on, so she can monitor his progress be sharing his whereabouts through the airport and meet him at the exit. with third parties [R6].

B – ELENA

Introducing Elena, who is Elena, a 39-year-old Spanish language professor, was visiting her 25not very IT-literate [R11] year-old niece Cristina in Frankfurt, but now is returning to Madrid with Aerolíneas Españolas. Elena does not speak German nor is her English very good. Moreover, she is not ‘IT-literate’. She does not travel much and finds the automated air transport procedures a bit overwhelming and difficult to follow. She owns an old mobile phone with limited features. Elena’s only smart device is her allergy bracelet (she suffers from gluten intolerance) which alerts her when by vibrating/flashing.

Elena did not misplace her paper ticket, although she is

a bit forgetful, but she could Cristina bought a paper flight ticket for Elena at a travel agency, and have done so [R4]. she now drives her to the airport with the help of her car’s computer, which is equipped with GPS and a telematics module. Cristina subscribes to a vehicle safety and efficiency service (which is also a location-based service, LBS) which is available to all cars There are always trade-offs. equipped with such modules. The service automatically selects the

The service to which Cristina

optimal route based on Cristina’s current location (which is

subscribes offers more

determined by her GPS and/or intelligent sensors in her car

automotive efficiency but it

interacting with roadside sensors), traffic conditions and local

also has a record of how fast

weather information communicated by the service. While the traffic she drives and where [R6]. information is downloaded in real time and displayed on the digital map shown on her car’s computer, Cristina’s location is revealed to her cell communication provider as well as her LBS provider. Airport staff, city administration and private companies share and co- Has Cristina agreed to their ordinate traffic data in order to minimise potential disruptions on sharing her data? [R6, R8] roads to the airport.

Does she understand what

Cristina earns points with the latter service when she uses specific

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 27

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

they are doing with her facilities and services, such as the airport parking lot, or when she data? buys from a specific store. So, upon entering the airport access road, the automobile’s licence number is captured by several digital video cameras. The video record is shared between commercial service providers as well as the airport security service. The LBS invites Cristina to use a specific airport parking and when she accepts, the garage parking assistance application guides her to the specific lot.

As expected, they arrive at the airport on time. However, Cristina must attend an urgent business meeting, so she can only help Elena with her luggage to the airport entrance where they part company.

The VID is a life-saver for

Elena must find her own way to the Aerolíneas Españolas check-in

Elena, otherwise she would

counter. As soon as she enters the airport, Elena approaches an

have had some problems

information kiosk to ask for more information on how to proceed

checking in and making her

next. As she doesn’t speak German or English very well, the assistant

way to her departure gate

gives her a visual interface device (VID) which is location sensitive,

[R1], but its capabilities are

with voice instructions in all EU languages. Elena selects the Spanish

limited to only the official

language and follows the instructions towards a manned check-in

languages of the EU. Slim

desk to drop off her luggage and collect a boarding pass, including

chance, but still how would

the luggage tag receipt. At the check-in counter, the attendant asks

Elena cope if she only spoke

her for the VID and keys in, as the final destination, the gate from

Basque or one of the other

which Elena should board. The VID provides her spoken and visual

minority languages? [R11]

information on her location inside the airport and how to get to the gate where she is to board. It will also alert her when boarding actually starts. The attendant tries to explain to her, with a lot of body language, that she will need to leave the device with an assistant at the boarding counter.

Elena’s language difficulties With more gesturing, the attendant asks Elena to press a finger hamper her check-in, but she against a scanner, which registers her fingerprint features and manages. Her difficulties encodes them in a 2D barcode which he prints off as part of her would be greatly boarding pass. This prevents Elena’s boarding pass from being used compounded if there were by another person. He gives her the boarding pass and VID. an operational failure or Following its instructions, she proceeds to the security check, and disruption [R1] then on to her gate. She’s relieved to see that she made it with less trouble than she feared.

As she still has plenty of time before her flight departs, she decides

Flying 2.0 - Enabling automated air travel by identifying and addressing the

28 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

to go window-shopping. She loses track of time, until her VID alerts her that her flight is about to start boarding, so she rushes back to the gate. When she presents her boarding pass, the airline attendant asks her (in Spanish, whew!) for the VID, which she hands over. Airline staff will return it in due course to one of the information kiosks.

Elena depends on the Having boarded the plane without incident, Elena is safely reliability of her allergy ensconced in her seat when, after take-off, the flight attendants bracelet to avoid a risk to begin distributing drinks and snacks. They hand her a bag of pretzels her health [R9]. And what if with an RFID chip imprinted on the bag. Elena’s allergy bracelet she has chosen to eat the recognizes the rice gluten content via communication with the chip pretzels despite of the alarm containing the product code and alerts her by vibrating/flashing; it is in the bracelet? also supposed to deliver a SMS on her phone and/or an alert through the Bluetooth connection; however, Elena has her phone

Apparently, Elena is

switched off, and the alert fails to be delivered. Elena chooses to

frustrated with her

ignore the vibration: the bracelet many times has vibrated even if

bracelet… What if she stops

the food was OK for her to eat, and she is rather annoyed with it.

using it? [R11]

She does, however, decline the snack, because she does not feel like eating pretzels. The flight attendant offers her some fresh fruit as an alternative.

As the flight heads south to Spain, Elena tries out the e-book reader in the seat-back pocket, a recent novelty introduced by the airline. Elena has never used one before, but her positive experience with the VID has encouraged her to try out this new technology. She selects one of the titles in Spanish. The device is intuitive and easy to use. The day’s excitement has made her a bit weary so she plugs in the accompanying earphones and turns on the e-book’s text-tospeech function. This is wonderful, she thinks to herself.

The LBS operator and taxi The flight lands on time at Madrid’s Barajas airport. Now, back on company both retain copies familiar ground, even if she is not a frequent traveller, she can easily of Elena’s response in case find her way around. She switches on her mobile phone as goes to they wish to offer her a collect her luggage. Since her niece had subscribed her to the LBS similar service in future. service before, so that she can find a taxi right away, Elena Elena does not know that immediately receives an SMS asking if she needs a taxi, and as she they retain her data feels tired, she replies “Yes”. Her response and GSM-based indefinitely in contravention coordinates are transmitted to an LBS operator which also serves a

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 29

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

of data protection legislation taxi company. As she exits the terminal, she receives a multi-media

[R18] messaging service (MMS) photo of the car which is waiting a few

metres away from her.

C – AKIRA

Introducing Akira Akira, a 20-year-old Japanese architecture student, is returning to

Tokyo, with Nihon Airlines, after studying on a scholarship at the Akira managed to get a visa, University of London. Before he left Tokyo a year ago, he was

but there could be a risk for

registered on the new Entry Exit system managed by the European

individuals wanting a visa if

Commission’s Directorate General for Justice, Freedom and Security

there is a failure in the

(DG JFS) and received a one-year visa for the time he was to spend

system [R5]. There could

in the UK. The entry system authenticates the visa holder by

also be a risk if an evil-doer

matching his fingerprints against the templates stored in the chip of

succeeds in getting a visa

his visa, somewhat like biometric passports. The entry system [R7], [R14], [R15]. records his name, date and place of entry.

The system could be a

Complying with travel regulations, Akira has filled out, 24 hours in

problem for people without

advance, his passenger name record (PNR) form, which he did online

fingers or with worn

and which he sent to the UK Home Office. The latter positively

fingerprints (e.g., many old

matched the PNR against his Global Entry registration data.

people) [R3]

The airline acquires more Still online, Akira visits the airline’s duty-free section and buys a few

data about Akira’s tastes gifts for his parents. The airline attaches RFID tags to the items

and interests [R6]. indicating that Akira is the rightful owner. The items will be loaded

onto the correct airplane based on his boarding pass information

and given to Akira when he is in mid-air.

Akira does not know how Akira takes the Underground to Heathrow. He pays for the journey

secure the card is, nor how using his RFID-embedded Oyster card. Transport for London (TfL)

secure is TfL’s storage of his maintains a record of Akira’s payments as well as all the travels he

personal data, nor whether has made using the card.

third parties have access to it. [R10]

Flying 2.0 - Enabling automated air travel by identifying and addressing the

30 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

The system works well as As Akira has not checked in yet, he goes to a kiosk in the departure long as all individual terminal where he uses his Nihon Airlines frequent-flyer card to components, nodes and links check in. He presents the RFID-embedded card to one of the work as they are supposed designated RFID readers. He is also asked to put one of his fingers on to, but they could fail [R3]. If the scanner, which compares it with the fingerprint features stored communications with the on his frequent flyer card, a procedure designed to prevent Home Office go down (e.g., someone other than Akira from using his frequent flyer card with his because of a fire), the whole boarding pass. The reader transfers information about Akira’s flight, system may crash [R13] seat number, etc., to the frequent flyer card and to the RFID tag embedded in his suitcase. Now Akira can use his card as a boarding pass. When he displays his card to the reader, which is linked to the airline’s departure control system, it confirms that he is indeed booked on the flight to Narita. At the same time, it updates the Passenger Information Unit (PIU) at the Home Office, which delivers an electronic travel authorisation (ETA), based on the processing of his PNR. He would not be issued an ETA if he had overstayed his visa period. This check-in procedure allows Akira to enter the restricted

Is there a fall-back system

area.

for people without fingerprints? [R3], [R4]

At the self-check in kiosk, the machine also adds Akira's flight details to the RFID tag embedded in his suitcase. The luggage tag receipt is

What happens if Akira is

then stored on his frequent flyer card. Akira can then drop off his

mistakenly on one of the

suitcase at the nearest baggage drop. Akira puts the luggage on a

various watch-lists

conveyor, which dispatches it to the Tokyo flight containers for his

maintained by EU border

flight.

authorities? [R2]

He then proceeds to the restricted zone, which he enters by presenting his frequent flyer card to an RFID reader and pressing a finger against a scanner which confirms that the card containing his boarding pass belongs to him.

As he is leaving the Schengen area, he is directed to an automated passport/immigration control. The combined biometric data from both his visa and passport are checked to verify that he is the rightful owner and that he has not overstayed his time in Europe.

People like Akira can be fed After passing the security check, he proceeds to his gate. He is faked information via social registered on a Japanese professional network site (JP-professionalsnetworking applications unite.com) and is interested in making new connections with

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 31

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

and, potentially, be exposed architects and interior designers, since he will be looking for a job in to fraud or other crime Japan. At the boarding gate, the application on his smart phone [R10], [R15]. detects someone from Tokyo Architects Ltd waiting to board the same plane. Akira sends a message, which the other accepts; they agree to identify themselves and soon they are chatting face to face.

Akira places trust, perhaps On board and in the air, Akira turns on his notebook and soon forms unwisely, in others whom he a peer-to-peer ad-hoc network with 15 other passengers who share does not know interests in travel to exotic places. Akira also connects to the Nihon Airline’s flight entertainment system’s free movie section and browses the movies but cannot find anything that he likes. However, he does find a couple of interesting documentary films, published under Creative Commons, about travels to South America which a fellow passenger shares on his video server. Akira spends some enjoyable hours viewing these. Akira reciprocates with some of the content and services on his notebook.

Akira exposes himself to

Akira also uses his notebook to select a Japanese dinner from the

behavioural advertising [R8]

Nihon Airlines in-flight service menu website.

and again [R8]

One of the in-flight attendant’s brings Akira the duty-free items he had previously purchased via the airline’s website. A match is made between the RFID tags on Akira’s boarding pass and on the tagged items. As an afterthought, he connects to the in-flight duty free shopping menu from his notebook and decides to buy a heavily discounted Swiss watch for his girlfriend.

Akira arrives at Narita airport and proceeds to the luggage reclaim, where an automated system returns all pieces of luggage exactly to their owners upon request. Akira approaches such a station and presents to a reader his frequent flyer card, which contains his luggage tags receipt. Within a few seconds, the system automatically moves his suitcases to the appropriate reclaim station, where Akira collects them.

The airport allows

collaboration with other As he does so, he receives a message from a well-established third party service providers, Japanese online dating service, to which Akira had been a subscriber raising questions about data and which is integrated with the LBS service of Narita airport:

Flying 2.0 - Enabling automated air travel by identifying and addressing the

32 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

sharing [R8], [R18] “Dear Akira-san, welcome back. We hope you had a good journey. It is our greatest pleasure to offer you this opportunity to meet Sakura-san, a young lady of exceptionally fine matching attributes based on your “Hazukashi Nain” (Shy Not) social network profile. Sakura-san is not far from your current physical location and is willing to communicate with you. Please push this button for an instant audio/video connection.”

But Akira has a girlfriend now and no longer wishes to receive such invitations. He wisely clicks on the “ignore” button and moves on towards the exit where his girlfriend and parents await him.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 33

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

4 ENISA EFR FRAMEWORK AND RISK ASSESSMENT METHODOLOGY

The European Network Information Security Agency (ENISA), has undertaken the development of a framework for the analysis and reporting of emerging and future risks in the area of information security. ENISA defines emerging risks as those that may have an impact between one and five years in the future; and future risks as those that may have an impact more than five years in the future.

4.1 THE EFR FRAMEWORK: CONCEPT AND PURPOSE

The EFR Framework is based around the use of predictive, narrative “scenarios”. The concept behind scenario planning is essentially simple: it facilitates the telling of realistic stories about possible (or probable) future events, based on extrapolation from present trends.

In the EFR Framework , the use of scenarios, rather than any other form of analysis, is intended to ensure that the extrapolations are both realistic and can be understood and appreciated by the decision makers. When building the scenario, a single technology, or prospective use of that technology, is selected for consideration. This is then built into a unique scenario that describes a situation in the future; in which that technology, or its functionality, has been deployed.

Once an area of EFR interest has been selected; a narrative story or “scenario” is written. The concepts underlying the story are then subjected to a risk assessment process, more information on which you may find in the next section. This looks at the technology and its use, as described in the narrative, in order to identify possible threats and vulnerabilities. From these, the assessment deduces the potential risk to the assets mentioned by the narrative.

The purpose of the ENISA EFR Framework is similar to that of classical scenario planning; in that it alerts those reading the report to possible future outcomes of current trends. However, the EFR Framework is both more narrowly targeted and more structured; in that it delivers a reasoned assessment of the risks inherent in the technology and its use.

EFR assessment reports should be read by appropriate target audiences in order to ensure that the risks (both positive and negative) inherent in a technology and its use are recognised and understood. If considered necessary and appropriate, comprehension of the risks will enable decision makers to take appropriate steps to manage and mitigate them, where possible.

At figure 1, below, is a simplified, outline flow diagram showing the processes of the EFR Framework. These are as follows:

A. Information Management

Flying 2.0 - Enabling automated air travel by identifying and addressing the

34 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

B. Topic Selection C. Scenario Building and Analysis D. Risk Assessment E. Assessment Reporting F. Promotion, Dissemination and Feed-back G. Continuous Improvement.

For more information on the EFR Framework, please refer to the ENISA EFR Framework – Introductory Manual [16].

4.2 RISK ASSESSMENT METHODOLOGY

The methodological approach used in this project to identify and assess emerging and future risks was based on the standard ISO/ IEC 27005:2008 Information technology — Security techniques —

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 35

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Information Security Risk Management [25]. In this endeavour, the ENISA team was supported by a group of external risk management specialists from Ernst & Young Greece. The evaluation scales and metrics have been customised to fit the project’s requirements. The following major steps were performed in the process of assessing the emerging and future risks:  Assets identification and valuation  Vulnerabilities identification and assessment  Threats identification and assessment  Identification of existing / implemented controls  Identification of final risks

In this step, we identified the major assets to be protected in the scenario and we estimated their value. For the purposes of our analysis, asset identification was performed at the composite asset level, meaning that personal and other type of data was identified as part of a physical asset (e.g. a smart device, a health monitoring device, a database etc.) and not as a separate asset. As such, the estimation of the value of the physical asset considered also the value of the data that resides on this asset. To estimate the asset value, we identified and considered the certain impact areas. Using a scale from 1 to 5 (Very Low to Very High), we estimated the impact in each area for each asset. The final asset value was the maximum of these values.

The purpose of this stage was to identify and assess vulnerabilities of the assets. A “vulnerability” refers to an aspect of an system / process (the assets) that can be exploited for purposes other than those originally intended, weaknesses, security holes, or implementation flaws within a system that are likely to be threatened. These vulnerabilities are independent of any particular threat instance or attack. In the evaluation of the vulnerabilities, a scale from 1 to 5 (Very Low to Very High) was used and the following attributes were considered:

Flying 2.0 - Enabling automated air travel by identifying and addressing the

36 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

 Severity: The severity of impact that will be incurred if the particular vulnerability is exploited. This includes the scope of the impact and the escalation potential (e.g.: where the exploitation of the particular vulnerability would subsequently lead).  Exposure: The ease of exploiting the particular vulnerability through physical or electronic means (required know-how, required resources).

It should also be noted that the vulnerability value was assigned when related to a specific asset, since the same vulnerability had different value in different assets. The vulnerability assessment also considered possible existing / implemented controls identified or assumed in our scenario.

This stage involved the identification and assessment of possible threats that could exploit the vulnerabilities of the assets identified. It should be noted that threats exist regardless of the vulnerabilities, and there are two major categories of threats to be considered: man-made and natural threats, namely threats due to humans (either accidentally or intentionally) and threats due to natural events (e.g. adverse weather conditions). Using the same scale of 1 to 5 (very low to very high), the threats are evaluated, considering the following parameters, especially for man-made threats:  Capability: The amount of information available to the threat agent (knowledge, training, technological sophistication etc.) and the availability of the required resources.  Motivation: The threat agent’s perception of attractiveness of the assets, danger of apprehension, and in general motive to violate standards and procedures

Please note that the function of these two parameters provides the likelihood of this threat to occur.

As controls we identified measures for protection and effective operation of the assets such as: policies, procedures, organizational and technological manual or automated mechanisms. Controls can be categorised as:  Preventive controls  Detective controls  Deterrent controls

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 37

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

 Corrective controls  Containment and recovery controls As our scenario is plausible, existing (implemented) controls have been identified in the form of assumptions in the scenario development. The expert group considered existing controls in the evaluation of vulnerabilities and threats. The values of which have been decreased in some cases due to the existence of these controls.

According to ENISA’s risk analysis methodology, the final risk and its value are a function of the three elements namely:

In practice, after identifying and assessing the vulnerabilities for every asset, the group followed these steps:  Mapping threats to vulnerabilities: In this step, the group identified possible threats that could exploit each vulnerability of each asset. It is the unique pairs of vulnerability and threat for a certain asset that produces a risk for this asset.  Risk value: As mentioned above, the value of the risk is a function of the asset, vulnerability and threat values. The asset values, and the threat and vulnerability levels, relevant to each type of consequence, are matched in a matrix such as that shown below, to identify for each combination the relevant measure of risk on a scale of 1 to 13. The values are placed in the matrix in a structured manner [25].

Flying 2.0 - Enabling automated air travel by identifying and addressing the

38 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

According to the standard, for each asset, the relevant vulnerabilities and their corresponding threats are considered. In principle, if there is a vulnerability without a corresponding threat, or a threat without corresponding vulnerability, there is presently no risk [25]. Now the appropriate row in the matrix is identified by the asset value, and the appropriate column is identified by the vulnerability value and the threat value. For example, for an asset with a value of 3, with a vulnerability valued at 4, which can be exploited by a threat valued at 2, the final risk produced is estimated at the value of 7, as shown in the figure below:

All of the steps presented above have been performed and are documented in an Excel file, which can be found in the attached Annex III of this report. The results for each step are presented in the relevant worksheet tab.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 39

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Following the identification and assessment of risks, to the group ranked the risks from very high to very low. Therefore, as the next step, the group identified possible controls and safeguards that could reduce those risks. For the purposes of this analysis, the risk mitigation step has been limited to the recommendation of potential controls to mitigate the risks identified. For example, acceptance levels have not been identified, as is the case in a usual risk mitigation exercise.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

40 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

5 RISK ASSESSMENT RESULTS

This chapter presents the results of the risk assessment are presented.

5.1 ASSETS – WHAT ARE WE TRYING TO PROTECT?

This section identifies the assets that we wish to protect against the risks identified in the previous section. Within the IoT/RFID air transportation context, can be tangible or intangible as well as be owned by various stakeholders such as passengers, states, airlines, or airport shops. Assets may include hardware, software, systems, data, business processes, buildings/facilities, equipment, or infrastructure. The values of the assets are different for different entities. For example, passport and ID cards are extremely important for passengers, because without them air travel would be almost impossible. On the other hand, passport and ID cards are not that pertinent for airport shops. Another example would be RFID and barcode readers. In 2015, this equipment will likely be extremely important to the airlines to enhance further the efficiency of check-in, boarding and baggage handling processes. Nevertheless, from a passenger’s perspective, these processes are transparent and, as such, the value propositions of such equipments are relatively low. Asset values also change over time. An after-flight boarding pass can still be valuable for frequent flyer mileage validation, but it is not as critical as it is a pre-flight one.

Assets have vulnerabilities that could potentially be exploited. These vulnerabilities expose assets to various risks. For example, future air transportation will depend heavily on computer network infrastructure for both data communication and system control. This heavy dependency on networking infrastructure exposes air transportation to the risk of network unavailability rendered by, for example, power failure.

During a meeting in Brussels in November 2009, experts used the IoT/RFID air travel scenario as a framework to identify assets likely to be owned by various stakeholders. After the discussions, the group agreed upon the following set of assets as significant within the 2015 air transportation context:

INTANGIBLE ASSETS

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 41

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

airport, together with the state-operated screening processes, they constitute the overall air transportation airport business process. The expert group considered the value of this asset as high. A2 – ELECTRONIC VISA ISSUING PROCESS This is the state-owned process of issuing electronic visas to foreign visitors. This process also includes making available the status of visas to the air transportation check-in, security screening and border control processes. This asset has a high value A3 – LUGGAGE AND GOODS HANDLING PROCESS Owned by airlines, airports, service providers and airport shops, this is the logistic process of moving goods to and from and within the airport. The goods include passenger luggage, airport shop merchandise and airport facility supplies. In a larger context, it can also include logistic processes of airplane maintenance. The value of this asset is considered high.

TANGIBLE ASSETS

Flying 2.0 - Enabling automated air travel by identifying and addressing the

42 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

- Electronic boarding passes - Electronic visa - Electronic luggage tags They may also store and/or generate: - Non-personal data - Passports and national ID cards - Passenger name record (PNR) data. The value of this asset is considered high. A7 – HEALTH MONITORING DEVICES Owned by passengers, and possibly by airlines or airports, these implants and/or biosensors are critical assets in monitoring citizens’ health. Examples include a body area network for blood pressure monitoring, allergy bracelet and seat-embedded motion sensors to detect lack of motion or overagitated physically-challenged passengers. The value of this asset is considered to be very high. A8 – TRAVEL DOCUMENTS ON PAPER Owned by the travellers as well as the airlines, airline tickets and boarding passes may be printed on paper. It is also possible that an RFID tag can be imprinted on or in paper. The value of this asset is considered medium. A9 – RFID TAG, RFID READER AND BARCODE READER Depending on the nature of the document or device to which it is attached, the RFID could be owned by travellers solely, airlines, states, shop vendors, or suppliers. An RFID tag can be on a card or imprinted on papers (e.g., boarding passes or luggage tags). Readers are typically owned by establishments such as airlines, airports or airport shops to authenticate boarding passes in performing business transactions or detecting customer browsing behaviours. Readers could be at automatic check-in kiosks, security control points, airport shops/shelves, as well as within the smart devices owned by citizens or passengers. The value of this asset is considered medium. A10 – CREDIT CARDS, DEBIT CARDS, PAYMENT CARDS, E-WALLETS Owned by the passengers or the issuing institutions, these cards may be with or without embedded RFID. Passengers use these assets to conduct transactions at various locations (e.g., check-in counters, airport shops, online purchase via smart devices). The value of this asset is considered high.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 43

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Flying 2.0 - Enabling automated air travel by identifying and addressing the

44 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 45

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

unauthorised access to another. The same is true if interoperability extends to interdependency in the case of failures and problems. I8 – TRUST: is essential in all aspects of the scenario. Passengers must trust the information on their devices. Operators must trust personal data provided, and information provided to them by other operators. Trust is also needed in the automated procedures by airlines and airport operators. And border authorities must likewise trust in the systems to perform. I9 –BUSINESS ACTIVITIES: includes all those activities performed by product vendors and service providers to generate revenues and earnings. Specifically, this impact refers to all non air transport related commercial activities within the scenario; these refer to commercial operations within the airport, such as duty free retail areas as well as those external to the airport such as commercial transportation entities.

5.2 MAJOR RISKS

Major risks have been categorised as follows:  Organisational and policy risks  Socio-economic risks: including privacy issues  Technical risks  Legal risks Within each category, risks are ranked according to their severity levels as indicated by the colour scale below.

Based on our detailed analysis which you can find in the excel spreadsheet of Annex III (Risk Assessment” tab), we have identified a total of 1306 individual risks. In the graphs below you can see an overview of the values of the risks identified (first graph) and a distribution of the individual risks (second graph); from the second graph, we can see that the majority of the risks of the risks identified

Flying 2.0 - Enabling automated air travel by identifying and addressing the

46 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

are ranked as Medium to High; it is noted however that there are individual risks that are considered Very High, and which you may find at the “Risk Assessment” tab of the excel spreadsheet of Annex III.

Individual risks - An overview Risk value distribution

For presentation purposes, we have grouped these individual risks into 18 major compound risks, for which we have calculated a weighted risk value. All of the weighted risks also range from Medium to

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 47

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

High. The following figure gives a graphical representation of the risk values of the individual risks (blue scatter dots) and of their weighted values (grey line) for the 18 compound risks identified in this report, and which are indicated on the line: the reader can navigate to the risks in this document by clicking on the respective risk number, indicated on the graph.

R2

In addition to a short description of the risk, the following items are identified for every risk in a table:

 The affected assets : as those have been identified in the previous section  The relative vulnerabilities and threats: you can click on each item to navigate to Annex I for more information  Reference to other risks: most of the risks identified are highly inter-related, so specific reference to other relevant risks is made. Again you may click on the item to navigate to the corresponding risk inside the document.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

48 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

 The risk level: as mentioned above, since the risks identified here are a high level grouping of all the individual risks identified in our analysis (see the detailed analysis in the spreadsheet of Annex III), a weighted risk level is estimated and included in the risk description.

Organisational and policy risks

Passengers and airlines may be unable to perform automated reservation, check-in, and boarding procedures due to procedural or operational errors, ill-designed procedures, introduction of erroneous data or even resource shortages from unexpected interruptions such as industrial action (e.g. strikes etc.). Some of these risks can be alleviated by means of technologies such as facial recognition, fingerprint scanning, but the overall effectiveness still depends on the original design as well as the operation and management of the screening processes.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 49

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

The risk of states’ inability to issue and control the usage of electronic visas arises from system failures, procedural incompatibility, equipment failures, cyber attacks, identity theft or usage of erroneous data. As a result, citizens/passengers are unable to obtain an electronic visa for their travel.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

50 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

This risk involves failure and compromise of passenger security screening process to detect weapons, explosives, liquids and gels due to malfunction of scanners, inconsistent procedures, malicious power failures, jamming, cyber infrastructure attacks, malicious insiders, and low social acceptance.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 51

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

The risk is an inability to travel resulting from loss or compromise of paper-based travel documents and no back-up for the e-transportation process due to theft, misplacement, identity theft, and fraud.

There are risks associated with the loss of luggage, personal goods, and airport store merchandise due to logistic handling system error, system components (e.g. RFID/readers) failures, social engineering, theft, cyber attacks, and general power failure. Such risks could also result from operation errors (e.g. RFID tags torn from the luggage) or unforeseen events (RF interference).

Flying 2.0 - Enabling automated air travel by identifying and addressing the

52 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Socio-economic risks

The natural characteristic of IoT air transportation is the prevalence of devices, sensors, readers, and applications which have the potential to collect a multiplicity of data types of individuals as they move through such environments. Many citizen air transportation data will be generated and collected for example as well as other forms such as location, purchasing habits, as well as other preferences stored for ease of use in systems. This leads to concerns over the potential compromising of citizen’s privacy via collecting/surveillance/profiting of traveller’s activity. Given the assumptions of an IoT scenario in terms of automation, interoperable networks, devices and databases as well as the proliferation of sensors we consider the risks to be high in this regard.

 Electronic passport/visa issuing data.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 53

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

 Ticket purchase/check-in/travel pattern/partner/time/price travel data.  Baggage handling data.  Credit/debit/payment e-card and e-wallet transaction data.  Citizen’s air travel and commercial transaction patterns.  Locations and correlation between location data of passengers.  Health monitoring data, sharing of these data to potentially conflict-of-interest entities such as health insurance establishments.  Correlation of travel data to all other online citizen data.  Spamming and undesirable exposure to solicitations brought upon by services such as LBS.

Citizen/passenger data are generated, and can also be potentially collected, starting from the very beginning of ID/passport issuing stage all the way through to visa application, ticket purchase, checkin, security-screening and boarding, as well as border/immigration control processes. States provide

Flying 2.0 - Enabling automated air travel by identifying and addressing the

54 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

and collect these data to facilitate the future air transportation process. However, these data also detail citizens’ mobility patterns and as such open the possibilities for abuses through practices such as profiling, unwarranted monitoring or data in governmental databases being compromised due to accidental loss, fraud or other illicit or criminal activity. Of particular concern here would be the storage and collection of biometric data. Linking identity to biometrics has often been raised as being problematic due to the risks of such data being compromised. While passwords or pins can be changed this is not true if an identity is compromised utilising biometrics. Subsequently, there are different types of risks associated with the databases owned by the states regarding citizens’ air transportation activities.  Upon the compromise, corruption or unavailability of the state-owned citizen air transportation databases, the authorities will not be able to issue travel credentials, authenticate validity of the IDs in providing critical support like boarder control, security screening and airline check-in processes.  Via the collection of citizen travel data, states potentially will gain enhanced ability to perform citizen surveillances via both real-time monitoring, as well as offline travel pattern analysis. This surveillance could be legal or illegal depending on the local and EU laws. Misuse and abuse of the citizen data could also come from state employees or people with privileged system access in performing criminal activities, such as illegal substance trafficking, extortion, or sale of the privileged data for commercial gains.  Cross compilation with various open and limited (secure) databases opens the possibility of gaining a capability for additional citizen surveillance.  Malicious perpetrators can also mislead state surveillance by feeding intentionally fake and erroneous data. A potential distributed denial-of-service (DDOS) can also be launched via the sensory infrastructure.  There is a risk of sharing and sale of personal data by commercial entities such as LBS providers who hold passengers’ location data.  Loss or compromised biometric data represents unique and potentially highly damaging risks in terms of identity theft.  Inaccuracies in data may mean that citizens may be inaccurately identified as ‘suspicious’ (false positives), while real perpetrators may not be appropriately detected (false negatives). Automated procedures utilising biometrics in checking databases may not be the ultimate panacea for identity related problems issues.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 55

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

The more data is collected, the more likely it is that data controllers and others will dream up ways in which the data can be repurposed. It is an almost inevitable tendency for people to maximise opportunities and minimise costs (by spreading costs over a wider range of missions). Usually ideas for these new opportunities for repurposing data occur only after the collection of data has begun. Thus, the risk is that data will be used for purposes in addition to those originally specified. Repurposing of data can, however, also be in the cards before data collection begins, e.g., law enforcement authorities or intelligence agencies may seek access to data collected by others for specified purposes. In some cases, the repurposing may seem relatively innocuous, for he massive collection of data, might result in the data used for other purposes that they were initially intended for. To provide an example, Richard’s dietary habits or requirements might end up being used as a basis to provide personalised advertisement to him or even by insurance companies to negotiate the amount of premiums, etc. The point is, however, that such repurposing is without the user’s consent and contravenes the provisions of the Data Protection Directive. Repurposing is one of the most insidious activities against privacy and data protection. It undermines trust and confidence.

This represents a critical risk for IoT enabled environments. This is not just in relation to the violation of individual rights to privacy but also may impact on wider social and public acceptance. To draw

Flying 2.0 - Enabling automated air travel by identifying and addressing the

56 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

parallels with other ICT developments 'spam' or junk mail remains one of the most negatively perceived impacts of increased internet access and usage by individuals. If IoT devices are all potentially areas where targeted or personalised messages can be received by individuals then 'spam' will take on whole new connotations. The proliferation of sensors recording data likewise is problematic in this regards. It remains unclear as to how privacy can be maintained and how practices of profiling and data mining can be curtailed. A pessimistic glance at the situation today often reveals flagrant disregard on the part of companies, and governments, for the privacy of individuals either accidentally or with specific intent.

Rapid advancement of ICTs has led to an increasing number of portable devices and sensors (Internet of Things) that enable various e-Health scenarios such as remote patient monitoring. It is expected that the “Internet of Things” will create significant impact to future delivery of healthcare. However, high dependability on the IoT technologies in e-Health creates significant security and privacy risks. For example, in the case of Richard, his medical data is not collected by healthcare providers in a controlled medical environment using certified medical devices, but by his own devices while he is on the move or devices in the airplane. This creates several significant risks related to the quality of the healthcare he receives, as his healthcare relies very much on the IoT technology. In particular, there are risks with respect to patient identification and reliability of collected information. It is important that: (i) the patient is properly identified (for example by the airplane sensors/devices which is related to V32 and V36) so that the measurements done by external sensors are associated with the right

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 57

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

person, and (ii) the measurements are taken with a reliable, certified sensor/device and that they are not modified on the way to the healthcare service (related to T10, T22, V7, V31, V33).

Another group of related risks are concerned with patient privacy. Once sensitive information about an individual's health is uncovered and social damage is done, there is no way to revoke the information or to compensate the individual appropriately for this damage. Next to that, the modern eHealth solutions based on IoT are heading towards open, interconnected environments which collect and rapidly exchange sensitive data making the problem more difficult. There are several threats (such as T3, T5, T8, T12), as well as vulnerabilities (V9, V19, V33, V38, V39) that can be exploited to endanger patient privacy, compromise his health records or misuse his health information for non-legitimate purposes (e.g. marketing, see also risk R8). Furthermore, there is a risk that the patient/consumer is not in control on how his data is shared and used due to the lack of proper end-to-end security mechanisms, not usable policy/consent specification techniques and the lack of respect to the transparency principle.

There are also different types of risks associated with the databases owned by commercial entities that collect and generate citizen/passenger data in future air transportation. These entities include,

Flying 2.0 - Enabling automated air travel by identifying and addressing the

58 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

but are not limited to, airlines, shuttle services, parking garages, baggage handling third-party companies, airport stores and various wired and wireless air transportation relevant service providers (e.g., travel planning, LBS-enabled travel assistance). Commercial interests such as operational efficiency, market analysis, consumer profile (anonymous or not) identification, are the major motivation behind such databases. Subsequently, there are also different types of risks associated with these types of databases.  The compromise and unavailability of these databases will render the intended business activities ineffective. In the case of airlines, without the passenger register/ticketing/check-in databases, the entire flight processes will be severely impacted. For shuttle services, similar passenger database failure will also significantly impact their passenger transportation process.  Similar to the state-owned databases, these commercial databases also contain passenger travel patterns. Additionally, consumer and personal activities such as airport store purchases, travel partners, hobbies and interests, interactions with other people, time of travel, dietary preferences and health conditions can all be collected. As such, these databases are open to potential abuses by commercial entities, hackers and malicious insiders with privileged accesses.  Cross compilation with other online Internet databases to gain additional consumer behaviour knowledge is a risk.  Similar to the state-own databases, erroneous and fake data could also be purposely generated by the malicious perpetrator to compromise the integrity of the database for devious commercial purposes.  It is unclear how such databases will be regulated within existing or future data protection regulatory frameworks. The challenges of data chopping, data mining and data outsourcing are already on the agenda for European Data Protection authorities and respective national organisations. In an IoT environment risks expand exponentially due to the ease with which data can be collected, stored and moved around.  Unobtrusive collection of data, while offering benefits to commercial operators (such as highlighting Richard's preferences discreetly in the scenario) raise critical questions in relation to consent. It would appear that in many IoT scenarios consent is assumed in relation to data sharing and data collection, yet this is against the provisions of data protection directives where consent must be explicitly given for the collection of data and its processing clearly explained to data subjects.  Likewise by expanding the commercial scope and value of transactions within an IoT environment then the value of being able to illicitly gain access to individuals data and credentials increases. It can be expected, just as with increased internet use has led to the emergence of identity theft as a

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 59

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

major source of criminal activity, that new or refinements of existing methods of criminal activity will emerge.

Some of these risks could be alleviated by using the digital anonymous technology to avoid, for example, Richard’s revealing his identity while paying for the shuttle service which takes him to the airport. As such, the implementation and design of the systems and their integration play a big part in the mitigation of these risks.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

60 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

The sometimes complex procedures and sophisticated devices may overwhelm users, the travellers that are not IT friendly or even airport / airlines personnel can be potentially included in this category of persons. This might result in errors in procedures or even failure to use them at all, but it may also result in serious user frustration, which may be further intensified when devices fail to work properly (e.g. give many false positives etc.). This may further raise the risk of low acceptance of the new technologies and applications. As it stands there is little large scale independent empirical research upon which to infer any conclusions as to how publics will interact or engage with IoT enabled environments. Linked to this is the observation that outside of research documents, or scenarios like these, little to no work has been undertaken in terms of raising public awareness or engaging with publics on the proposed developments that IoT will bring.

The scenario assumes that technologies are relatively widely used and that they are acceptable for most, even to the extent of helping Elena navigate the confusing (to her) process of boarding her plane. Yet this remains a substantial assumption. Likewise Elena while having difficulties with IT may have had further problems compounded by disability, age, a nationality other than European all of which would further complicate her time in the airport. A level of refusal to use any IoT enabled services must also be considered [though unlikely if assumptions in the scenario such as with PNR and entry/exit automated systems occur]. Providing an opt-out solution for individual citizens from these environments must be considered and can represent a significant challenge for states, airports as well airline operators.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 61

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Since we are talking about an Internet of Things scenario, the collection of data and profiling are both facts and not necessarily negative per se. However, excessive data collection and profiling, will inevitably lead to social sorting practices for commercial or other purposes, leading to exclusion of people from accessing services. Like repurposing of data and mission creep, social sorting in an increasing temptation with increasing data collection. It may seem at first glance that social sorting enables governments to more efficiently provide services and to better target citizens who might be at risk, but closer examination shows that social sorting often comes with evils, consumers who are targeted because they offer better commercial prospects inevitably means that other consumers are ignored or marginalised. Social sorting enables insurance companies, airlines and many enterprises to provide some deals to their valued customers and not to others. Even fast-tracking in airports is a form of social sorting. In the long run, social sorting risks damaging notions of equality and democracy.

Some examples of this can already be seen in the increasing proliferation of 'trusted traveller' schemes where for a financial premium people can avoid the normal queues and delays associated with other types of travellers at European airports.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

62 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Other technologies referred to in the scenario, such as for example, biometric related devices may even just exclude by the nature of how they function. In this instance both the very old, the young may have problems with fingerprinting or iris scans [eye disease etc].

Profiling and data mining within an IoT scenario such as the one described is massively increased as a potential harm to individuals due to the ease to which data can be collected, stored, shared and analysed. Over reliance on the content of databases [such as security related ones] may likewise be problematic in instances where mistakes are made. The recent attempted bombing of a flight bound from Schiphol to Detroit in December 2009 also illustrates, by virtue of the fact that would-be bomber’s status on a no-flight list was not updated and highlights the difficult balancing act between individual rights to privacy and the requirements of security that will exponentially increase as databases become ever larger and more sophisticated within IoT environments. Individual access to remedy incorrect data being stored on them should be seen as a key goal yet it represents a challenge given the wide range of potential databases that might be in existence with the widespread implementation of IoT technologies and systems.

Technical Risks

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 63

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

This risk involves computer and network infrastructure failure that leads to major paralysis of the overall automated air transportation process. This includes both the wired and wireless infrastructure as well as critical components (e.g. servers, routers, software services). Many of these sensors and readers require wired or wireless infrastructure to deliver their data. Additionally, the whole system may require network access to backend servers. The current internet infrastructure is an integral part of providing future IoT air transportation. Depending on the degree of computing network infrastructure failure, the impact to air travel could be severe.

An important factor that makes this failure even more severe and more likely is the excessive reliance on the technological infrastructure that is characteristic of this new environment. There may be an over-reliance on passengers’ smart devices as the foundation of future air transportation, which becomes apparent in the event of an overall system failure due to compromise of these smart devices and loss of functionality due to wireless/IT infrastructure failure, equipment/reader malfunctions, theft, devices’ weak access control, jamming, social engineering or cyber attacks.

Over-reliance may also become apparent with paralysis and interruption of the air transportation process resulting from malfunction of critical technology components such as barcode scanners, RFID tags and RFID readers due to electro-magnetic interference, vibration and age. As in the case of passenger authentication via biometric authentication, fingerprint and iris scanners may be ineffective to certainly aged passenger or people with finger injury or damage . Such risks arise from nonmalicious “malfunction” of biometric sensors and are facts of technology limitations. Manual processes can be devised to address them.

Hard failures could result from hardware (e.g., kiosks, terminals, readers, RFID) malfunctions, virus attacks, denial-of-service/flood attacks or drive-by downloads of malicious code. Also, for portable devices, the battery could be discharged rendering the device useless.

Airport facilities such as garages, driveways, check-in halls, screening/border-controls areas, restrooms, lighting, HVAC (Heat, Ventilation, and Air Conditioning), plumbing, elevators/escalators, gates, public address systems are all critical parts of the future air transportation process. Many of these facilities can and will be integrated with IoT of the future – for example, HVAC (as well as plumbing systems) can be integrated with various temperature, vibration or pressure sensors at strategic locations. Data from these sensors could be read or accessed through mobile RFID readers or smart phones. Under such circumstances, the physical failure of the facilities is tightly linked with the

Flying 2.0 - Enabling automated air travel by identifying and addressing the

64 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

management of the IoT devices, in addition to risks arising from structural, electrical or terrorist causes.

This risk involves compromise, loss of function and theft of RFID-embedded passport and national ID cards due to system, device or equipment malfunction, identity theft, social engineering, RFID cloning, cyber attacks and lack of remote revocation process. Identity theft poses a risk not only to those whose identities are “stolen”, but to commercial and governmental undertakings as well, for example, fraudulent use of another’s identity may impact banks and credit card companies as well. Identity theft creates a social burden, for example, on law enforcement authorities who try to combat such fraud as well as policy-makers who are obliged to divert time and resources from more socially productive uses. Hence, identity theft is a drag on our societies and economies as well as deleterious to the individuals directly affected.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 65

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

This risk involves inconveniences and failure to conduct air transportation business transaction processes due to the loss, theft, unauthorised access, rogue cards and/or readers, attacks, spoofing and incompatibilities of both RFID and non-RFID embedded credit, debit and/or payment e-cards and e-wallets. This risk is, of course, directly linked with others, for example, realisation of malicious attacks on the infrastructure and systems might render the services unavailable or it might lead to identify theft.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

66 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Ground transportation is an important feature in the future IoT air transportation scenario. Getting passengers and goods in and out of the airports, garage parking and effective traffic control all require cohesive integration of vehicles and ground transportation infrastructure. Faults and malicious attacks (e.g., blocking, jamming, side channel attacks, rogue readers and RFIDs, physical RFID destruction) could significantly impact air transportation, creating traffic jams and accidents. Vehicle systems as well as communication infrastructure are evolving and are useful to improve the efficiency and robustness of ground transportation systems, but at the same time, if failing or manipulated, they may induce new risks. Standards and designs of these systems and how they could integrate with the future air transportation process need to be managed effectively to minimise any consequent risks.

Legal Risks

The rapid advance of technology is at variance with the slower pace of the legislative processes, which may lead to serious legal gaps in a future environment of Internet of Things, particularly in the context of air travel. These gaps pose a big challenge to Member States and the European Institutions to

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 67

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

tackle, since inadequate legal protection may have severe negative impacts on the everyday lives of European citizens.

Currently there is a strong data protection legislative framework in place, which is likely to be adapted by 2015 to better deal with the challenges posed by the technological developments, such as the Internet of Things. Nevertheless, there are certain concerns and risks relating to the processing of personal data, as seen from the vulnerabilities and threats presented in the table above. Some of them arise from the challenge of assuring compliance with the legislation, since as we experience every day it is not something easily achieved.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

68 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

5.3 IMPLEMENTED CONTROLS IN SCENARIO 2015 – ASSUMPTIONS MADE

The following table presents existing controls envisaged in the scenario that is assumption of controls implemented at the time the scenario takes place. Notably, assuming that these controls are in place decreased the value of some of the vulnerabilities identified that would have been higher if this assumption was not made.

It is therefore noted he identification of these envisaged controls was considered necessary so as to make the scenario more reality-checked: a certain level of protection had to be assumed. In view of this, what makes the presentation of this control very important is that these assumed implemented controls may also serve as indirect recommendations of the IoT/RFID group, since they have been deemed as a sine-qua-non in such an environment. Additional recommendations to address the risks that are identified even after the application of these measures, are presented in the next chapter.

Control description Control Control Affected Explanation of control category nature assets

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 69

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Control description Control Control Affected Explanation of control category nature assets

Flying 2.0 - Enabling automated air travel by identifying and addressing the

70 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Control description Control Control Affected Explanation of control category nature assets

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 71

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Control description Control Control Affected Explanation of control category nature assets

Flying 2.0 - Enabling automated air travel by identifying and addressing the

72 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Control description Control Control Affected Explanation of control category nature assets

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 73

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Control description Control Control Affected Explanation of control category nature assets

Flying 2.0 - Enabling automated air travel by identifying and addressing the

74 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Control description Control Control Affected Explanation of control category nature assets

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 75

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Control description Control Control Affected Explanation of control category nature assets

Flying 2.0 - Enabling automated air travel by identifying and addressing the

76 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Control description Control Control Affected Explanation of control category nature assets

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 77

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Control description Control Control Affected Explanation of control category nature assets

Flying 2.0 - Enabling automated air travel by identifying and addressing the

78 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Control description Control Control Affected Explanation of control category nature assets

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 79

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Control description Control Control Affected Explanation of control category nature assets

Flying 2.0 - Enabling automated air travel by identifying and addressing the

80 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Control description Control Control Affected Explanation of control category nature assets

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 81

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Control description Control Control Affected Explanation of control category nature assets

Flying 2.0 - Enabling automated air travel by identifying and addressing the

82 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Control description Control Control Affected Explanation of control category nature assets

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 83

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

6 RECOMMENDATIONS

Given the envisaged opportunities of the IoT, and in order to take full advantage of these, we would need to address the major risks identified in the previous paragraphs. In principle, apart from certain risks that are inherent to the technology of IoT/RFID, as we have seen the majority of the risks posed has to do with the ways the technology is used and is thus not a solely technical matter, so the solutions to address them cannot be only technical either. In this section, we provide some initial recommendations to mitigate those risks; the recommendations are made for the various stakeholders, e.g. industry, academia, research institutions, civil society organisations, ENISA etc, in three areas: policy, research and legal. We have also identified specific recommendation for the European Commission, since one of the objectives of this report is to provide some initial recommendation to the EC on these issues, as specified also in the EC Communication COM(2009) 278 [9].

Policy recommendations

Technology solutions are not and cannot be regarded as the total and only solution. Appropriate processes, including human interaction, always need to be in place. These processes also have to address potential failures of technical systems in the overall risk management design. As long as such processes exist, high-tech dependency is not necessarily by itself a critical risk – given that the probabilities of the breakdowns and relatively low and potential impacts can be managed by appropriate backup procedures with a reasonable effort and workload for the persons involved.

In the case of Richard in the scenario described above, losing his smart phone device due to theft or accidental damage would be detrimental for his air travel if all the necessary e-documents were stored on it. However, if a secure online backup procedure was in place, then the risks could be reduced to a mere inconvenience. In the same sense, in the case of the IT-illiterate Elena, systems must be designed considering usability requirements, so that all potential users will be capable to use them in an adequate manner.

Considering the above, we recommend the following:

Rethink existing business structures and introduce new business models

As we have seen in the scenario, future air transportation is bound to bring in devices/sensors/application that generate data and create business processes integration that was never possible before. For example, sensors and readers at various parts of the airport (check in counter, luggage handling systems, gates, maintenance hangar, or even on the airplane) will provide

Flying 2.0 - Enabling automated air travel by identifying and addressing the

84 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

visibility and data that can be used for tighter system integrations and, as such, allow for tremendous opportunities for business process improvement. This evolution is also bi-directional. While IoT encourages enterprises to perform vertical business process integration improvement, the process improvement itself also guides the evolution of the IoT implementation (e.g. where to put the sensors, what types of new readers are needed). More importantly, enterprises should regard IoT beyond mere incremental improvement and investigate totally new business models (e.g. new way of air transportation) to achieve strong competitive advantages.

In addition, with the availability of various IoT computing partners, data, and services, air transportation businesses can pro-actively seek the possibility to create new business models that significantly improve future air travel (e.g. via horizontal integration with partners, or existing services).

It is thus recommended that air transportation businesses and agencies (e.g. airlines, airports, air cargos/logistics, and government aviation security agencies) proactively plan, design and stay alert on the introduction of new business models. This is expected to mitigate the following risks identified in this report: R1, R3, R4 R5, R11, R13, R15.

User-friendliness of devices and procedures / be inclusive

As the air transport system is supposed to be operated and used by people having different skills and coming from different cultures, the usability of the technical solutions has to be considered thoroughly. Processes have to be clear and comprehensible, and user interfaces have to be designed in such a way that the corresponding systems will be easy to use by their target groups.

It is recommended that usability studies and investigations be conducted prior to and along with the development of new technologies. New devices and services should undergo a trial period, in which regular end users of the systems shall be involved. This of course could be a research recommendation as well.

Moreover, in order to make the procedures as inclusive as possible and to avoid any discrimination in service provision, alternative check-in and boarding procedures should exist for people who have lost their eyes or are otherwise physically challenged and cannot therefore provide biometrics etc. Also, while recognising the efficiency and efficacy of airlines issuing electronic boarding passes, paper-based boarding passes should continue to exist for those who are digitally challenged.

Raise awareness / educate specialised personnel and citizens

In view of the characteristics of this new environment, it is crucial to increase awareness and promote education of citizens and airports’ personnel on the security and privacy risks posed by these new technologies and ways to be prepared, as well as on the use of the new devices / technologies /

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 85

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

applications. As even highly automated processes still require human operators, it is important to develop and provide adequate training and instructions for airline, airport and other ground personnel. The training shall address how to use the new procedures and technologies (e.g. paper boarding passes, smart devices, RFID-enabled frequent flyer cards, RFID-enabled luggage tags) for all relevant processes (e.g. check-in, boarding, luggage check). Also guidelines for handling contingencies (e.g. system failures, emergency or crisis situations) have to be developed.

At the same time it is imperative that the state developed and organised appropriate awareness and educational programmes and activities for citizens, so that they are aware of the security and privacy in terms of security and they face in such an environment. This appropriately complements the recommendation on developing user-friendly and inclusive interfaces for end-users. Both are equally important in a future IoT environment.

By all means the programmes and activities targeted to one or the other should be different in a nature. The education, training and provision of appropriate awareness to specialised personnel should be mainly driven by the industry, organisations and companies, while general awareness campaigns for the citizens and public, should be mainly steered by the states, civil society organisations (e.g. consumer organisations etc.), the European Commission, ENISA etc .

Develop and adopt policies for data management and protection

User data will play an important role in the described air travel scenario, and thus it is imperative that clear policies for their collection, usage, storage and deletion are developed and adopted [see also relevant recommendation in research and legal made below]. Data minimization techniques should be used (collect data based on needs) and proper access control mechanisms need be in use. Policies for gaining users' consent when gathering data and how the data is used need to be developed. Furthermore, the mechanisms for transferring and enforcing these policies should be standardized.

In addition, sufficient support is provided to data subjects so that they get adequate information relating to the processing of their personal data and they can better exercise their rights. In this context, we recommend that:

 signs be posted prominently in airports indicating the presence of CCTV cameras and other surveillance technologies;  information sheets or leaflets be made available to passengers passing through security checks in airports informing them of the storing of their biometrics (e.g., who is storing the biometrics, for what purpose, for how long, whether any repurposing of the biometric data is expected and whom citizens can contact for further information).

Flying 2.0 - Enabling automated air travel by identifying and addressing the

86 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Finally, we would recommend that local authorities and government transport departments put backup procedures in place in the event of a failure of an intelligent transport system (ITS) (e.g., roads embedded with sensors communicating with passing vehicles).

Research recommendations

IoT technologies involve an increasing number of smart interconnected devices and sensors (e.g. cameras, biometric and medical sensors) that are often non-intrusive, transparent and invisible. Moreover, as the communication among these devices, as well as with related services is expected to happen anytime, anywhere, it is frequently done in a wireless and ad-hoc manner. Next to that, the services become much more fluid, decentralized and complex. Consequently, the security barriers in Internet of Things become much thinner (see the risks on electronic identification failures and realization of malicious attacks, R14 and R15). It also becomes much simpler to collect, store, and search personal information and endanger people's privacy (see the risk on loss/violation of citizen privacy, R6, as well as compromise and abuse of databases, R7 and R8). Moreover, a fear is rising that control over personal information is increasingly getting out of hands of people (see the risks on aggressive profiling and social sorting leading to social exclusion, R11, as well as R10on repurposing of data). Finally, a lot of people might not feel engaged with new technology and even fill irritated with its complexity (see the risk on user frustration and low user acceptance, R9). Obviously, this goes beyond the risks people are used to nowadays, leading to new requirements. Therefore, research related to security and privacy of IoT technologies becomes very important. In particular it is recommended to address the following fields:

Data protection and privacy, by conducting research to examine the issues in relation to IoT deployments and to further extend security and privacy solutions. In particular, research is needed to support: (i) proper trust management, (ii) end-to-end policy enforcement and efficient rights management in highly distributed systems, (iii) data disclosure, usage, and purpose control, (iv) effective cryptographic techniques for devices/sensors with limited resources and privacy-preserving identity management and (v) architecting privacy-preserving systems, applications and services, as well as retrofitting existing ones to enable privacy options. This will further support and enhance a security and privacy by design approach.

Usability, by investigating the issues related to usability of security and privacy technologies, and consequently research and development in the related technical fields including human-device interfaces and assisted privacy policy (consent) specification and management. This should also address discriminatory or exclusionary aspects of how information is presented to citizens (including IT-illiterate).

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 87

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Proposing standards of light cryptography protocols

Recently, a lot of research has been undertaken on light cryptography in the context of RFID, and many new protocols have been proposed (see, e.g., http://www.avoine.net/rfid). In spite of the large number of available methods, there are very few which were examined enough to be considered safe. There are examples of situations, where new light cryptography algorithms were widely deployed, and after some time of usage, serious security gaps were found by researchers (e.g. well known cases of MiFare Crypto-1 and Digital Signature Transponder). In any case it has to be considered that the security of encryption cannot be based on secrecy of algorithms. Contrariwise, the algorithms should be public in order to allow all interested researchers to test them (cryptanalysis). A protocol can then be considered secure if no security gaps were found. We recommend developing light cryptography standards and giving some time to the scientific community to test them before wide implementation.

In addition, based on the combination of light-weight cryptography protocols (for light duty devices usage), as well as the regular cryptography framework (e.g. PKI - Public Key Infrastructure, for backend infrastructures) should be analyzed and implementation technology and testbeds (e.g. ellipticcurve cryptography mutual authentication RFID) be explored. A very important consideration in this is key management: such a holistic framework, should identify the actors generating the encryption keys (private/public keys) , how these will be distributed and who (which agencies/companies/authorities) will eventually be given access to such keys when necessary (e.g., to find information/cross-link data about suspects etc).

Managing trust

It is obvious from the risks identified, that lack of trust is a detrimental roadblock to next generation IoT air transportation implementation. Trust should thus be a central consideration; an enterprise should identify and understand its own trust framework in order to be able to deal with the IoT challenges. The most salient characteristic of IoT-driven pervasive computing is the formation of transient trust within a highly mobile environment. These trust relationships dictate how the devices, sensors, readers and operators exchange data and operate together (e.g. how much a passenger's smart phone can interact with the airport concession kiosk). See also research recommendation on ‘Proposing standards of light cryptography protocols’.

It is also recommended to focus particularly on the appropriateness and the compliance aspects of trust policies into the IoT applications. The policies should be appropriately developed and implemented, so as to ensure trust and should be complete in their specification, e.g. considering many different aspects, such as ethical, legal and business implications. Once they are in place, due care should be exercised, so that these policies are complied with and are consistent across any system integration.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

88 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Multi-modal person authentication

Automatic authentication of people is key to efficient and secure operational procedures in the air transport system. Experiences show that current implementations of biometric systems still show some weaknesses, even if they in principle seem to be promising. Using multifactor authentication (e.g. password plus biometrics, biometrics plus token) has the potential to increase overall security. In the same way, multimodal biometrics (several biometrics used in parallel) will make the authentication process more robust to errors and circumvention. Another aspect is the option to increase system flexibility by providing alternative (spare) authentication factors, which can be used in those cases where the basic way of authentication is not available (e.g. iris scan could be used for persons not having fingerprints).

In conclusion, the recommendation is to further investigate and develop biometric procedures for person authentication. Research work should be extended to investigate and advance single technologies and, in parallel, to develop multi-modal solutions, which combine dissimilar technologies in order to overcome their individual weaknesses.

Legal recommendations

Based on the risks identified in the previous section, and in view of the serious challenges regarding data protection that are envisaged in this new environment, we recommend that:

 The entities that process personal data, including any governmental or commercial entity, such as electronic communications providers, road infrastructure providers, airline companies or any other entity in the air transport sector, shall value highly the security of the personal data of the data subjects and shall take all the necessary technical and organisational measures to ensure it. More specifically, we recommend that: - citizens be notified of breaches concerning their personal data; - national audit offices compile statistics regarding the sectors, the companies and the government departments that have sustained the most data breaches; - companies and government departments are required to include in their annual reports an estimate of the risks posed by compromise of databases containing personal data, as well as information regarding the steps they have taken to minimise such risks by securing such databases (e.g., encryption of the data, physical access control measures, remote back-up of databases); - the government departments and companies involved in the international air transport sector be required to conduct Privacy Impact Assessments (see also Recommendations for the European Commission) before any decisions are taken to deploy projects or programs affecting privacy.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 89

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Moreover, the Article 29 Data Protection Working Party has noted the lack of harmonisation in the collection of data by airport shops from passengers making purchases. In addition to the above, the IoT/RFID expert group agrees with and supports the conclusions and recommendations of the Article 29 WP, in particular, that  Shops and customs authorities should be aware that data collection should be restricted to what is strictly necessary, applying the principle of data minimisation. In most cases, shops should only need to collect the flight number/destination mentioned on the boarding pass.  Data should not be used for law enforcement purposes unless they are necessary as evidence of abuse in specific cases (no bulk transfers to police).  Data should not be used for other purposes incompatible with the original purpose (disclosing data to third parties without information or consent, for example, to carriers) unless they are used for statistical purposes.  There shouldn’t be any systematic compilation of customers’ purchases to allow for analysis of their behaviour and buying habits.  The retention period should be limited to the strictest necessary and should be harmonised across Europe. We also note that one of the main results of the Art. 29 WP’s investigation of duty free shop practices was that information provided to passengers is insufficient. We recommend that airport operators oblige vendors and service providers in airport to provide passengers adequate information about their collection of personal data, why it is collected and how it is to be used. The Art. 29 WP also expressed concern that neither the provisions of the Excise Duty Directive nor data protection provisions are uniformly applied and respected across Europe by duty-free shops. Like the Art 29 WP, we recommend that there be further harmonisation of the current practice and efforts be made to raise awareness among travellers as to the collection and processing of data when purchasing duty-free items. Some further legal recommendation are identified in the section below on recommendation for the European Commission.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

90 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Recommendations specific for the European Commission

Given the importance of these technologies and the issues of IoT/RFID, and also given the current initiatives of the European Commission towards addressing the concerns already raised on RFID and Internet of Things [9], [10], [11], we have identified below some particular recommendations for the European Commission to act upon.  We recommend that the European Commission prepare guidelines on the better enforcement and application of the European regulatory framework, especially in view of the challenges posed by technological developments. More specifically, we recommend that: - amendments of data protection legislation be introduced to give Data Protection Authorities (DPAs) stronger powers to audit companies or government departments with regard to their compliance with the relevant data protection legislation and that DPAs should be given the resources needed in order to achieve this task; - the European Commission negotiate amendments to the EU-US PNR agreement so that there is transparency what the US does with PNR data, whether such data is shared, and so that European citizens have access to their data in a timely, low or no-cost way. - the European Commission gives a priority to the regulation of profiling and behavioural marketing in order to ensure the protection of the data subject from their consequences.  We further recommend that the European Commission:

- adopt an ‘end-to-end’ approach for securing IoT/RFID applications: appropriately mitigating IoT/RFID risks lies beyond securing the RFID tags, it actually extends from smart devices to readers and back-end databases - in order to improve the usability of future research results, and align research with industrial and societal needs, promote the participation of industry, and in particular SMEs in research activities as FP7. More specifically, we recommend that the Commission reinforce pilot activities in the line of the present CIP ICT-PSP programme with more ambitious targets and measures for participation of SMEs, and also initiate support actions, to better disseminate the results of such research to them; - encourage more (and better) research at EU level on the ethical limits of private data capture and circulation, and on the societal implications of developments in this regard, e.g. under the Science and Society programme of FP7. - endorse and promote awareness raising and educational activities for the citizens, as well as other specialised audience (professionals, personnel etc.)

Security in flights may be subject to emotional decisions that are taken only to please public opinion. New technologies can and must be used to improve security; however, rushed decisions may have a

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 91

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

cosmetic effect (i.e., satisfying public opinion) but open more security questions than they can fix. Moreover, it is important to follow and promote the approach of security and privacy by design, so that security and privacy are considered in the early stages of development of applications and technologies, being thus features of the systems and not mere add-on functionalities.

It is thus recommended that any decision on the introduction of new technologies and new procedures should be taken only after a privacy, security and technology impact assessment and by a joint panel with representatives comprising all stakeholders (industry, civil society organisations, legislators, technology experts, health experts, data protection authorities, ENISA etc.), truly tested and adopted jointly by all Member States. The European Commission should appropriately endorse and steer such a process.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

92 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

7 GLOSSARY AND ABBREVIATIONS

ACI Airport Council International BCBP Bar Coded Boarding Pass DCS Departure Control System DG Directorate General DPA Data Protection Authorities EC European Commission EDS Explosive Detection System EFR Emerging and Future Risks ETA Electronic Travel Authorisation GA German Air GNSS Global Navigation Satellite System (or Service) GPS Global Positioning System IATA International Air Transport Association ICAO International Civil Aviation Organisation IFE In-Flight-Entertainment IoT Internet of Things IPF Ideal Process Flow IS Information System IT Information Technology JLS Justice Liberty and Security LAGs Liquids and Gels

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 93

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

LBS Location Based Service MMS Multimedia Messaging Service MRO Maintenance, Repair and Overhaul NFC Near Field Communication PCP Physically Challenged Passenger PDA Personal Digital Assistant PET Privacy Enhancing Technology PIN Personal Identification Number PIU Passenger Information Unit PKI Public Key Infrastructure PNR Passenger Name Record RT Registered Traveller RFID Remote Frequency Identification SIM card Subscriber Identity Module card SPT Simplifying the Passenger Travel SSD Solid State Drive StB Simplifying the Business SUICA Super Urban Intelligent Card TB Tera Byte VIS Visa Information System VPN Virtual Private Network

Flying 2.0 - Enabling automated air travel by identifying and addressing the

94 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

8 REFERENCES

1. Adey, Peter, Secured and Sorted Mobilities: Examples from the Airport, Surveillance & Society, Vol. 1, No. 4, pp. 500-519. Available at: http://www.surveillance-and-society.org

2. Albrecht K., McIntyre L. (2005). Spychips. How major corporations and government plan to track your every move with RFID. Nelson Current 2005.

3. Bachelor, Lisa, Ryanair scraps airport check-in, The Guardian, 14 May 2009. Available at: http://www.guardian.co.uk/money/2009/may/14/ryanair-online-check-in

4. Bar-El, H. (2003). Introduction to Side Channel Attacks. Whitepaper, Discretix 2003. Available at: http://www.discretix.com/wp.shtml

5. Bono et al. (2005). Security Analysis of a Cryptographically-Enabled RFID Device. 14th USENIX Security Symposium, pages 1--16. USENIX, 2005. Available at: http://www.usenix.org/events/sec05/tech/bono/bono.pdf

6. Bowcott, Owen, Face scans for air passengers to begin in UK this summer, The Guardian, 25 Apr 2008. http://www.guardian.co.uk/business/2008/apr/25/theairlineindustry.transport

7. Courtois, N.T; Nohl K. & O’Neil S. (2008). Algebraic Attacks on the Crypto-1 Stream Cipher in MiFare Classic and Oyster Cards. Cryptology ePrint Archive: Report 2008/166. Available at: http://eprint.iacr.org/2008/166.pdf

8. Estrin, Deborah (ed.), Embedded, Everywhere: A Research Agenda for Networked Systems of Embedded Computers, Committee on Networked Systems of Embedded Computers, National Research Council, National Academy Press, Washington, D.C., 2001. Available at: http://www.nap.edu/openbook.php?isbn=0309075688

9. European Commission, Communication from the commission to the European Parliament, the Council, the European Economic and Social Committee and the Committee of the Regions: Internet of Things — An action plan for Europe, COM(2009) 278, Brussels, 18.6.2009

10. European Commission, Commission Recommendation on the implementation of privacy and data protection principles in applications supported by radio-frequency identification, C(2009) 3200 final, Brussels, 12.5.2009

11. European Commission, Commission Staff Working Document accompanying the Commission Recommendation on the implementation of privacy and data protection principles in applications supported by radio frequency identification, SEC(2009) 586, Brussels, 12.5.2009

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 95

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

12. European Council, Regulation EC 2252/2004 of 13 December 2004 on standards for security features and biometrics in passports and travel documents issued by Member States, OJ L385/1, 29.12.2004

13. European Data Protection Supervisor (EDPS), Opinion on the Communication from the Commission on an Action Plan for the Deployment of Intelligent Transport Systems in Europe and the accompanying Proposal for a Directive of the European Parliament and of the Council laying down the framework for the deployment of Intelligent Transport Systems in the field of road transport and for interfaces with other transport modes, Brussels, 22 July 2009.

14. European Economic and Social Committee, Opinion on Aviation security for passengers (2009/C 100/07), Brussels, 23 October 2008.

15. European Group on Ethics and Science in New Technologies (EGE), Ethical Aspects of ICT Implants in the Human Body, Opinion to the Commission, 16 March 2005. Available at: http://europa.eu/comm/european_group_ethics/docs/avis20en.pdf

16. European Network and Information Security Agency (ENISA), Emerging and Future Risks Framework – An Introductory Manual, March 2010. Available at: http://www.enisa.europa.eu/act/rm/emerging-and-future-risk/emerging-and-future-risksframework-introductory-manual

17. European Parliament and the Council, Regulation (EC) No 300/2008 of 11 March 2008 on common rules in the field of civil aviation security and repealing Regulation (EC) No 2320/2002, OJ L 97, 9.4.2008.

18. European Parliament, Resolution on the impact of aviation security measures and body scanners on human rights, privacy, personal dignity and data protection, Brussels, 23 October 2008. Available at: http://www.europarl.europa.eu/sides/getDoc.do?pubRef=-//EP//TEXT+TA+P6-TA- 2008-0521+0+DOC+XML+V0//EN

19. Finkenzeller, K., Flörkemeier, C., [et al.] (2004) Security Aspects and Prospective Applications of RFID Systems, Federal Office for Information Security (BSI). Available at: https://www.bsi.bund.de/cae/servlet/contentblob/475744/publicationFile/27966/RIKCHA_englisc h_Layout_pdf.pdf;jsessionid=85804244C5ED7038E6EFEBC9723C4740

20. Fishkin, K.P. and Roy, S. (2003). Enhancing RFID Privacy via Antenna Energy Analysis. Tech. memo IRS-TR-03-012, Intel Research Seattle, 2003.

21. Ford, Richard, Government bows to EU, undermining £1.2bn electronic borders scheme, The Times, 18 Dec 2009. Available at: http://www.timesonline.co.uk/tol/news/uk/article6961141.ece

Flying 2.0 - Enabling automated air travel by identifying and addressing the

96 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

22. Hancke, G. & Kuhn, M. (2005). An RFID distance bounding protocol. IEEE SecureComm 2005, 5-9 September 2005, Athens, Greece

23. Hancke, G. (2005) A Practical Relay Attack on ISO 14443 Proximity Cards. Manuscript, February 2005

24. Hicklin, A; Ulery, B; Watson, C, The Myth of Goats: How many people have fingerprints that are hard to match? NIST IR 7271, September 2005

25. International Standard ISO/ IEC 27005:2008 Information technology — Security techniques — Information Security Risk Management, 2008

26. Juels, A. (2005). Attack on a Cryptographic RFID Device. RFID Journal, 28 Feb. 2005. Available at: http://www.rfidjournal.com/article/articleview/1415/1/39/

27. Juels, A. ; Rivest, R. & Szydlo, M. (2003). The Blocker Tag: Selective Blocking of RFID Tags for Consumer Privacy. Conference on Computer and Communications Security - ACM CCS, October 2003

28. Kfir, Z. & Wool, A. (2005). Picking virtual pockets using relay attacks on contactless smartcard systems. SecureComm, September 2005.

29. Kirschenbaum, I. & Wool, A. (2006). How to Build a Low-Cost, Extended-Range RFID Skimmer. IACR eprint, February 2006

30. Leppard, David, Spy centre will track you on holiday, The Sunday Times, 8 Feb 2009. Available at: http://www.timesonline.co.uk/tol/travel/news/article5683677.ece

31. Maghiros, I.; Rotter, P. & van Lieshout, M. (editors): RFID Technologies: Emerging Issues, Challenges and Policy Options. EUR Technical Report, EC DG-JRC, IPTS, 2007.

32. Michaels, Daniel, and Andy Pasztor, Lufthansa to Upgrade to Better Wireless Connections, The Wall St Journal, 12 Oct 2009. Available at: http://online.wsj.com/article/SB10001424052748703790404574467072334949300.html?mod=go oglenews_wsj

33. Miller, Claire Cain, It Knows Where You Are, and What You’re Looking For, The New York Times, 2 Nov 2009. Available at: http://www.nytimes.com/2009/11/03/technology/internet/03local.html?_r=1&ref=technology

34. Modinis Study on identity Management in eGovernment, Study prepared for the eGovernment Unit, DG Information Society and Media, November 2005

35. Page, Lewis, Interpol proposes world face-recognition database, The Register, 20 Oct 2008. http://www.theregister.co.uk/2008/10/20/interpol_face_scan_plan/

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 97

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

36. Rankl, W. & Effing, W. (2004). Smart Card Handbook. John Wiley & Sons Ltd, 2004.

37. Reid, J., et al. (2006). Detecting Relay Attacks with Timing Based Protocols. Proceedings of the 2nd ACM symposium on Information, computer and communications security, Singapore 2007, pp. 204-213

38. Rieback, M.; Crispo, B. & Tanenbaum, A. (2006). Is Your Cat Infected with a Computer Virus? Pervasive Computing and Communications - PerCom 2006, March 2006.

39. Rotter, P. (2008): A Methodological Framework for the Assessment of Security and Privacy Risk for RFID Systems. In: IEEE Pervasive Computing, Vol. 7, No. 2, April/June 2008, pp. 70-77.

40. Scott, Jennifer, Heathrow rolling out facial recognition tech, ITPro, 30 Nov 2009. http://www.itpro.co.uk/618298/heathrow-rolling-out-facial-recognition-tech

41. Stone, Brad, As Phones Do More, They Become Targets of Hacking, The New York Times, 20 Dec 2009. http://www.nytimes.com/2009/12/21/technology/21cell.html

42. Welt Online, EU lawmakers criticize ‘virtual strip search’, 23 Oct 2008. http://www.welt.de/english-news/article2614271/EU-lawmakers-criticize-virtual-strip-search.html

43. Wortham, J. (2007). How To: Disable Your Passport’s RFID Chip, Wired, vol. 15, no. 1, 2007. Available at: www.wired.com/wired/archive/15.01/start.html?pg=9

Flying 2.0 - Enabling automated air travel by identifying and addressing the

98 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

ANNEX I – VULNERABILITIES AND THREATS LIST

VULNERABILITIES

This section presents the vulnerabilities identified by the expert group. Vulnerabilities become risks only when they are exploited by a threat (see next section).

This vulnerability could be due to lack of accountability, high complexity of procedures, assigning extensive responsibilities to end-users (in critical parts of the procedures), etc.

An excessive dependency arises when one relies on IT systems. It is a sort of “mug’s game” in the sense that virtually every system will fail to a lesser or greater extent at some point or other.

When things do go wrong, there is no adequate back-up system in place to take over. Availability/robustness has not been considered in the system design, , or appropriate failure modes have not been addressed.

This includes unfriendly authentication mechanisms, too frequent requests for password change, too quick automatic log-offs, etc. This vulnerability may also arise because there has not been sufficient training given to staff in detecting and understanding security threats.

This vulnerability is due to the difficulty of using device interfaces. The interfaces are not intuitive or user friendly. It may arise from excessive or unnecessary functionality options available to the users. A device may be too complicated for ease of use.

A simple example of the lack of interoperability appears when the RFID reader at the airport cannot write data to the RFID tag on Akira’s suitcase. This vulnerability is depending on the governance.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 99

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

This vulnerability arises when systems do not collect enough or appropriate data or garble the data they do collect. For example, the data collected by passenger name records (PNR) may not be sufficient to identify a terrorist or an improper entry on no-fly lists, incorrect entries in relation to visa status, and mistaken identification of individuals by commercial entities. The problems of this were clearly highlighted by the failure of databases in respect of the attempted bombing of a flight from Schiphol bound for Detroit in December 2009 .

If a natural disaster, for example, disrupts an airport’s power system, everything comes to a halt.

This vulnerability may refer to systems, devices, data access or network access. This also includes authentication of RFID and RFID readers, and since many RFIDs are writeable, this may increase the vulnerability.

Poorly designed devices or systems may create a vulnerability, whereby they are not sufficiently robust or resilient to withstand attacks by hackers (for example) or they may not do what is expected of them, especially at critical times.

Biometrics are not 100 per cent reliable. Part of the reason why they are not may occur at the enrolment stage when an individual’s iris or fingerprints or other feature are scanned.

Security or other procedures may vary from one airport to another, creating opportunities for evildoers.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

100 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

It’s often been said that the weakest link in any system is human. If personnel are inadequately trained, they become a vulnerability. They need to be trained adequately to detect and understand security threats and what to do in the event of a system malfunction.

Airports with insufficient equipment may create a security vulnerability. The vulnerability might also pose problems to the efficient processing of passengers from check-in to boarding.

Too many people may have access to personal information. Often the biggest threat comes from insiders.

The data collected and processed shall be adequate, relevant and not excessive in relation to the purposes they are collected. An example of such lack of respect to the data minimisation and proportionality principles can be mentioned the case, when an LBS system collects not only the information absolutely needed for the provision of the service, but it also stores excessive information. The need-to-know principle is not enforced by any means.

When the purpose limitation principle is not respected, more data are collected and processed than is strictly necessary the specified purpose. For instance, Christina’s approximate physical location is revealed to both the cell communication provider as well as the navigation service that provides the map and traffic conditions applications.

Lack of respect to the transparency principle means that the data subject is not able to determine the relevant data processing practices. In the IoT a lot of information is transmitted and processed via automated processes, most of which remain unnoticed by the data subject.

While the traffic and local map are being downloaded in real time, Christina’s approximate physical location is revealed to both the cell communication provider as well as the navigation service that

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 101

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

provides the map and traffic conditions applications. Appropriate identity management would protect Christina's privacy in this case.

Biometric identification has relatively high error rates (especially automatic face recognition). Also modern biometric sensors (especially fingerprint and iris sensors) are difficult to compromise (‘liveness detection’), still is also possible to spoof them. Awareness of imperfection of biometric systems is an important factor of overall security [P. Rotter (ed.) Biometrics Deployment Study. Large-scale biometrics deployment in Europe. Identifying challenges and threats. JRC-IPTS report EUR 23564 EN 2008, ISBN 978-92-79-10657-6. Available at: http://ftp.jrc.es/EURdoc/JRC48622.pdf

Inherent vulnerability of cards and devices (passports, RFID tags, etc.): they are small in size, and they are easy to lose, be stolen and/or copied.

Malicious RFID readers may be able to operate from a distance several times longer than the intended range (Kirschenbaum & Wool 2006). Moreover, shielding of RFID is often not possible.

Unlike mobile phones or PDAs, most RFID tags cannot be turned off and are always ready to send data for a request received by radio waves. This feature is an inherent vulnerability.

In RFID and contactless smart cards, due to limited resources, the methods for protection against reverse engineering, such as dummy structures, scramble buses and memory cells, etc., are rarely applied. Active methods for detection of reverse engineering attack are impractical in these devices.

In case RFID and contactless smart cards, due to limited resources, manufacturers often apply light cryptography and proprietary cryptographic methods.

Some devices are not 100 per cent reliable. They may produce inaccurate results or make false positives or negatives.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

102 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Devices used by a great number of people every day [health issues (e.g. infectious diseases spread by fingerprint scanners)]

Face-based identification has the highest social acceptance among all biometric identification methods. Unfortunately, it has also high error rates, which leads to many false alarms and/or false acceptances.

Different databases or data stored at different locations serving different purposes are / can be linked, thus enabling greater data matching, data mining, profiling, data aggregation or social sorting. Key question here is who is doing the linking and why – it could be for security reasons (catching terrorists before they fly), but it could also be for commercial exploitation by airlines, vendors, service providers operating in the airport as well as by evil-doers seeking to undermine air travel, airport systems or engaged in spoofing, phishing, spamming.

Many entities are collecting personal data, but rather fewer of them have procedures in place enabling individuals (data subjects) to see what data they have about them. Procedures for correcting incorrect data may not exist or may be cumbersome and bureaucratic.

Although Member States have transposed the EU Data Protection Directive, they have not done so in a fully harmonised way. In addition, there are lacunae in the legislation so that some matters are not addressed.

Due to limited resources, RFID tags often use light, proprietary cryptography, which in some cases is not sufficient. Identifiers of tags which are sent in the beginning of communication are not encrypted at all (as a part of anti-collision protocol) and they may be used e.g. for tracking of people.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 103

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

The processing of personal data is supposed to be legitimate. However, some data controllers and data processors may not have obtained the informed consent of data subjects.

Personal data are supposed to be deleted when they are no longer necessary for the purposes for which they were collected or processed.

Data subjects are supposed to be given the opportunity to rectify incorrect data or to block its further use. For instance, Akira wishes to unsubscribe from "Hazukashi Not" service and to have his account deleted.

THREATS

A denial of service attack is sabotage, aimed at disrupting a service for fun or to achieve political or illegal goals. A DOS attack is sometimes known as a buffer overflow attack or flooding..

This threat is a stepping stone to achieve next stage of sabotage or penetration.

The ease with which data can be collected, aggregated and mined coupled with the motivation of large financial paybacks make this a widespread threat. Roger Clarke coined the term dataveillance to describe the phenomenon of surveillance by means of data analysis. Both airports and governments may also have an interest in analysing data, to prevent terrorist related incidents, to develop more targeted advertising.

This threat is often found in conjunction with or preparation for another attack aimed at revealing protected sensitive operations. The threat gleans data implied in network communication patterns. Traffic analysis requires special skill and knowledge to be effective.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

104 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

This is one of the most common attack methods, especially for information collection. However, such attacks on RFID and smart cards do not occur very often. Such attacks are usually carried to appropriate others’ identity rather than getting access to restricted areas or data, which is usually encrypted. Man-in-the-middle (or relay) attacks for contactless smart card has been theoretically analysed by Kfir and Wool (2005). For practical aspects, see Hancke (2005). Countermeasures such as distance bounding based on response time (Hancke & Kuhn 2005; Reid et al. 2006) or signal-to-noise rate (Fishkin & Roy 2003) are rarely applied.

Social engineering attacks are widespread and too-often effective. They play upon gullibility or human psychological weakness. Phishing could be regarded as a form of social engineering.

There will always be evil-doers engaged in theft of others’ property, be it smart cards, smart phones or whatever. Theft is not, of course, the only crime. Extortion, fraud and many other crimes are common in cyberspace.

This attacks refers to unauthorized access to data stored on RFID, smart cards (especially contactless) and personal devices. Also databases can be a subject of attack though the network, as well as data can be illegally accessed and modified by unauthorized personnel.

Loss or misuse of a card or device is also a common threat.

Given the security implications of the non-identification of particular passengers (as in the recent Detroit example mentioned) unreliable data can have major implications for safety and security. Less dramatic risks could include for example allergy bracelets as described in the scenario incorrectly.

This threat arises when, for example, a passenger doesn’t follow instructions and makes a jam in the automated passport/immigration control or smart corridor.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 105

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

This threat arises when governments and business do not comply with provisions of data protection legislation and the principles stated therein, for example, regarding data minimisation, purpose specification, proportionality, informed consent, access to data by the data subject, etc.

Function creep occurs when data are used for other purposes than the ones for which they were originally collected for. For example, in the air traffic scenario, a car rental company doing some market analysis might approach an airport operator to gain access to its data on airport parking.

For example, an attacker might use a fake fingerprint with a stolen passport to board the plane.

An RFID clone can be either physically similar to the original tag or can be a notebook with a special antenna. Cloning is relatively easy for basic tags but even some advanced and apparently well protected tags with a challenge-response protocol have been cloned (Juels 2005; Bono et al. 2005; Courtois et al. 2008).

This threat can arise as a result of stealing or cloning authorisation tokens (like smart cards).

Smart cards or RFID tags may be subject to side channel attacks based on information gained from physical implementation of a cryptosystem, like variations of power consumption, time of computations or electromagnetic field (Bar-El 2003). It is often combined with other cryptanalysis methods.

RFID or a GSM network can be blocked by exploiting vulnerabilities of information exchange protocols. Blocking can be also useful as a way to protect consumers’ privacy (Juels, Rivest, Szydlo 2003).

Jamming is malicious interference of a radio transmission. It can result in denial of service and forcing a system to use fallback procedures. Large-scale jamming requires extensive equipment setup and

Flying 2.0 - Enabling automated air travel by identifying and addressing the

106 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

exposure of the transmission source. It is not commonly practised unless with a clear and critical agenda.

RFID Tags can be read by any RFID reader. Therefore, rogue RFID readers can scan for RFID and be used for unauthorized reading of information from a tag. As RFIDs often have light cryptography schemes (if any), powerful back-end systems can break the code in minutes, making the security protection ineffective. The range of a reader may be extended several times beyond the standard communication distance, for example ISO 14443 cards with standard range 10 cm can be scanned from 25-35 cm, which is enough to read a card in someone’s pocket. Main countermeasures are: encryption, authentication of the reader, using short-range tags, shielding tags with an anti-skimming material (e.g. aluminium foil) and moving sensitive information to a protected database in the system's backend.

The easiest way to disrupt RFID systems is to physically destroy the tags. Destruction becomes a serious issue when RFID tags are used as anti-theft protection. RFID tags in e-passports can be destroyed by owners who have concerns about possible abuse of their privacy – especially as an epassport with a non-working RFID tag is still valid (Wortham 2007).

This threat occurs when systems or devices malfunction due to hardware/software/implementation errors.

Worms, viruses and malicious code are a part of our daily cyber life. They are a prevalent and effective way of disrupting systems. Even very simple RFID tags, such as those used for tagging goods, can carry a malicious code (Rieback at al. 2006).

This threat might be aimed at forcing a system to use fallback procedures, e.g., in order to get unauthorised access to restricted areas.

Unjustified political agendas often lead to excessive surveillance on citizens. Every described case (true or invented) dramatically decreases trust and acceptance of technology (especially biometrics, RFID).

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 107

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

This threat is of low probability but potentially high consequence. The destruction wrought by natural disasters is difficult to predict. It could affect airport and telecommunication (network) operations.

Personal mobile devices may create ad hoc networks in order to exchange data and information between users. These networks can be used by attacker to break into personal devices and compromise the communication and information exchange between parties. For example, DOS attacks can flood ad-hoc networks; rogue participants can de-route or compromise legitimate messages and information exchanges.

RFID is perceived by many people as a privacy threat. They have been called "spychips" (Albrecht, McIntyre 2005). Most of the concerns presented during an EU public consultation on RFID were related to privacy (Maghiros, Rotter, van Lieshout 2007). Also some biometrics have low social acceptance, especially fingerprints which are commonly regarded as linked to criminal investigations.

The abundance of data collected and processed in the IoT and their storage in databases (commercial and state) facilitate their linkability.

The abundance of data collected and processed in the IoT can lead to the creation of user profiles (relating to consumer preferences, travelling habits, etc.).

The automatisation of the processes in the IoT threatens to exclude the data subject from the data processing process.

The use of unique identifiers, such as the human fingerprint, is increasingly being used for trivial transactions, such as in the case when Elena registers her fingerprint in order to "secure" her boarding pass.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

108 challenges of IoT & RFID technology

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

ANNEX II – SCENARIO BUILDING AND ANALYSIS TEMPLATE

Please refer to accompanying document.

Flying 2.0 - Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 109

Final Report

Identifying emerging and future risks in a future IoT/RFID air travel scenario

ANNEX III – RISK ASSESSMENT SPREADSHEET

Please refer to accompanying document.