Flying 2.0 - Enabling automated air travel by identifying and addressing the challenges of IoT & RFID technology: Annex I

IoT/RFID Scenario Risk Assessment Annex I - Scenario Building & Analysis Template

Flying 2.0 Enabling automated air travel by identifying and addressing the challenges of IoT & RFID technology

ANNEX I – Scenario Building and Analysis Template

Flying 2.0 – Enabling automated air travel by identifying and addressing the challenges of IoT & RFID technology

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

About ENISA Contact details:

Flying 2.0 – Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 3 3 3 3 3 3 3

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Structure of the template

The template is structured as follows:

 Introductory part, where a general overview and the background to the scenario is provided

 The Scenario description, including the following information: - Scenario type: explorative (what can happen) or predictive (what will happen) - Scenario raw description: this is where the scenario is described in free text. The intended text in italics provides more technical information on how certain activities are performed. These details are not necessarily those of which actors are fully aware as they happen in the background. - Assumptions: Any assumptions made while formulating the scenario.  “Framing the scenario” – This section contains a number of fields, with information we would like to know. Since most of this information required may already be included in the raw description, this section is actually offered as an alternative, in case experts instead of providing a free text, prefer to introduce their input directly to a more structured template. This would also provide us with specific information we need for the Analysis phase.

 “Analysing the scenario” – This section is the borderline between the scenario analysis and risk assessment of the specific technologies and applications we have chosen. In this template, at this point in time we will identify the assets only.

 A Glossary – Lists the abbreviations used throughout the text, where important terms like “threats”, “vulnerabilities”, etc. are defined.

 Other information where more information not specified in the table above could be specified, or figures and pictures added, etc.

 References, where all references used for completion of the tables should be listed.

Flying 2.0 – Enabling automated air travel by identifying and addressing the challenges of IoT & RFID technology

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Introduction: why an IoT/RFID air travel scenario

The “Internet of Things” (IoT) , sometimes referred to as the ubiquitous network or pervasive computing environment, is a vision where all manufactured things can be IT-enabled and connected to each other via wireless or wired communication networks. While there is no unique definition for the Internet of Things, a commonly accepted one is the ITU-T definition from 20052, saying that development of item identifications, sensor technologies and the ability to interact with the environment will create an Internet of Things. The Internet of Things is envisaged to bring many benefits, but it also poses many challenges and risks. The purpose of this scenario and its follow-on analysis is to identify the emerging and future risks and to make recommendations to address them appropriately.

In the context of our work in WPK3.13 identification of emerging and future risks, we have decided to investigate a scenario on Internet of Things / Radio Frequency IDentification (RFID) technologies in future air travel. Given that we are already seeing the introduction and use of smart technologies in air travel (e.g., RFID-enabled passports, electronic boarding passes sent using SMS and displayed using cell phones, etc.), we consider this as a representative, rather realistic, emerging, showcase scenario on which we can elaborate to identify other important risks and challenges posed by IoT technologies. Among the technologies in this scenario are smart phones, netbooks, RFID and location-based services (LBS), but the power of these technologies is greatly leveraged by their convergence. This scenario will serve as a test bed to illustrate the convergence of these IoT technologies and the issues that arise as a result of such convergence.

Scope and overview of the scenario

This scenario is explorative and is set in the future, approximately five years from now in the year 2015. We follow three passengers of different citizenships (EU, US, Japan) flying from European airports. The scenario depicts emerging automated procedures typically used in normal air travel, such as check-in and boarding. Different criteria have been used to select the passengers starring in the scenario, namely:

Flying 2.0 – Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 5 5 5 5 5 5 5

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

 Nationality: Richard is a US citizen, Elena is Spanish and Akira is Japanese  Age: Richard, Elena and Akira, belong to different age groups: 52, 39 and 20 years old respectively.  Health: Richard is a diabetic and has serious heart problems, Elena is healthy overall, but has an allergy condition and Akira is healthy  IT “literacy”: While Richard and Akira are familiar with technology; Elena faces some basic problems with the use of technology and finds it quite overwhelming following the air travel procedures using smart devices.  Language skills: Elena does not speak German and has difficulties in communicating even in English. The others two can both speak English and Richard German as well.

The scenario takes into account current work being carried out by Airport Council International (ACI) and IATA Simplifying the Passenger Travel (SPT) [see Figure 1], an international interest group comprising representatives from governments, security agencies, professional organisations, technology vendors, airports and airlines, and driven by the International Air Transport Association (IATA), the international syndicate of airlines. The scenario considers the IATA-SPT Ideal Process Flow (IPF) [see Figure 1] and shows how new devices such as smart phones, RFID and LBS can contribute to improving the flow of passengers through airports and onto their aircraft and thereby cutting costs for airlines, airports and other stakeholders while, at the same time, improving security.

Flying 2.0 – Enabling automated air travel by identifying and addressing the challenges of IoT & RFID technology

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Figure 1 – The technology response to the growing demand from airlines and airports for passenger automation.

In the context of the current and emerging procedures for processing passengers, the scenario also examines how the Internet of Things could pervade future air transportation from the perspectives of industry and consumer stakeholders.

The scenario is constructed of several phases based on the air travel process and involves the following:  Getting to the airport and pre-flight arrangements  Getting ready to fly: airport check-in, boarding, security controls  In flight  Arrival and transfer

What’s out of scope

The following fall outside the scenario’s scope:

Flying 2.0 – Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 7 7 7 7 7 7 7

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

 ENISA works in first pillar activities, so it cannot enter into issues of national security that fall within the third pillar. For this reason, border control issues fall out of the scope of this assessment. Any border control mentioned in the scenario is only for completion purposes, as this is an inherent part of the air travel process, and we want to keep the scenario realistic.  The focus is mainly on passengers. Due to limited time and resources, the scenario does not consider in detail security personnel, airline crew and other airport personnel, who may have different access requirements.  Aircraft security and general aviation maintenance, repair and overhaul (MRO) procedures are not considered, as they would considerably increase the complexity of the scenario.

Flying 2.0 – Enabling automated air travel by identifying and addressing the challenges of IoT & RFID technology

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Flying 2.0 – A ‘smart’ RFID/IoT air travel scenario

Type of scenario Explorative, what can happen based on standards acceptance [“predictive” or “explorative” to and IT technology implementation, as well as acceptance and indicate the nature of the scenario] adoption by passengers and citizens of devices and networks.

Raw description of scenario

[who does what or what happens. The intended text in italics provides more technical information on how certain activities are performed. These details are not necessarily fully understood by the actors

and they happen in the background.]

A. Meet Richard, Elena and Akira

Frankfurt 2015.

Richard is a 52-year-old US citizen who has been working in Germany and now is flying back to Atlanta, with German Air (GA), for his vacation. He has had two heart surgeries over the years and carries a pace-maker. He also has a serious chronic diabetes condition for which his doctor has implanted an inbody blood sugar level monitoring sensor . The monitoring system can communicate with his doctor in case of an emergency using Richard’s smart phone as a gateway. This system is also capable of announcing itself to the surrounding environment and equipment (e.g., body scanners or smart corridors to reduce the energy level).

As a non-EU citizen resident in Germany, Richard has enrolled in the registered traveller (RT) program at the German Ministry of Interior offices in Frankfurt [see assumption 3].

He has recently bought a new smart phone with NFC functionality in order to use a personal healthcare service while he is on the move. The smart phone is able to collect data from his implanted blood sugar level sensor and forward its measurements to a “steady-sugar-level” diabetes service to which Richard subscribed. The service monitors Richard’s blood glucose level and provides him advice with respect to his diet and activity.

Frankfurt airport is equipped with the latest technology of the Fast Track Program shared by participating airlines. Furthermore, the system is fully integrated with the airlines’ departure control system.

Flying 2.0 – Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 9 9 9 9 9 9 9

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Elena is a 39-year-old Spanish citizen and a Spanish language professor. She has been in Frankfurt to visit her 25-year-old niece Cristina who lives there, and she is now flying from Frankfurt to Madrid with Aerolíneas Españolas. Elena does not speak German and her English is also not very good. Moreover, she is not really IT-literate. She does not travel much and finds the automated air transport procedures a bit overwhelming and difficult to follow. She owns an old mobile phone with limited features. Elena’s only smart device is her allergy bracelet, which her doctor especially requested her to wear, in view of her condition (she suffers from gluten intolerance).

Meanwhile, in London, Akira, a 20-year-old Japanese architecture student, is leaving London for Tokyo, with Nihon Airlines, after studying on a one-year scholarship at a UK university. When Akira arrived in London a year ago, he was registered on the new Entry Exit system. This system authenticates the Schengen visa holder by matching his fingerprints against the templates stored in the chip of his visa. The system records his name, date and place of entry.

B. Getting to the airport and pre-flight arrangements

Richard

Richard, who is an “Elite frequent flyer” member of his airline’s program, confirmed his flight and selected his seat 24 hours in advance with his smart phone. To do this, he logged in with his frequent flyer number and his PIN code and then selected the online check-in menu. This check-in menu is accessible via both computer and personal digital assistant (PDA). As a result, he received and stored in his smart device a token for his check-in data, as well as information and alerts on his calendar. This token is used as his boarding pass. When registering as a frequent flyer member, Richard registered his fingerprints to the airline. When the token is issued, it is encoded with his fingerprint preventing someone else from using his token [Assumption No 17]. During the check-in process, Richard asked for a luggage service, an additional offering to pick up passengers’ luggage from their homes. When the service personnel arrive at his house, Richard communicates his boarding pass data from his smart device to their mobile devices which include RFID readers. These readers are used to write information on RFID-enabled luggage tags , passenger and flight data and other relevant data such as weight, priority handling or insurance, become attached to

Flying 2.0 – Enabling automated air travel by identifying and addressing the challenges of IoT & RFID technology

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Richard’s luggage before it is taken, loaded on the service car and taken to the airport. Throughout the travel, the RFID tags will be read by scanners at various locations in the luggage transportation chain, and the data they contain will be stored on the relevant system. Richard is also reminded to point his smart phone at the tags to record their number, and then the driver takes the luggage to the airport. This enables Richard to get a receipt, stored in his smart phone, of the luggage tags, to be on the safe side. Richard has also filled in, 24 hours in advance, the EU PNR form at the GA website, where he provided personal information including his name, date of birth, nationality and passport issuance data. These data were then processed and validated by the German Passenger Information Unit (PIU) . As Richard has no luggage to carry, he decides to travel to the airport using Diamond Airport Shuttle Express. He subscribed to a new web-based travel service application on the Internet called “WhereToGo”. WhereToGo automatically books the shuttle for him based on his departure time and prior arrangements found on his calendar. Once the shuttle is reserved, acting like a secretary, WhereToGo inserts the Shuttle reservation, pick-up time and fare information into Richard’s calendar. WhereToGo service knows Richard’s approximate location. His identity does not have to be communicated to the shuttle service. Then, however, GA announces an unexpected three-hour delay of his departure flight. WhereToGo immediately re-books the shuttle, updates his calendar and informs him with a voice alarm. Richard makes good use of the available time to respond to e-mails and finish reviewing some reports. When the time comes, an alarm rings on his device and he goes to the indicated location to get the shuttle. The shuttle service uses car-to-roadside communication to continuously update its route and time planning to ensure on-time arrival at each pickup location and at the airport. After picking up Richard, the shuttle bus receives information from road-side units (RSU) at the intersection ahead about a car accident blocking traffic. The shuttle bus takes an alternative route to avoid the traffic accident and they arrive at the airport on time. The on-board unit (OBU) on the shuttle bus communicates continuously with road-side units it passes on the way to the airport. The car that has been in the accident has sent information to the nearby RSU regarding the type of collision (sensors on the car register where the impact is), time of collision, number of people in the car, seatbelt status, if the airbags have been deployed, car velocity during the impact etc. This information is relayed to police, fire and ambulance personnel who can decide what type of response to take. Based on this, the RSU will communicate necessary information to the nearby cars with recommendations (if it is a huge accident or involves dangerous goods, divert all cars; if it is a small accident confined in one lane, divert some cars and let other cars through).

Flying 2.0 – Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 11 11 11 11 11 11 11

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Before arrival, the shuttle driver requests payment and Richard pays the meter plus tip using his smart device, which also doubles as an e-cash purse. A record of the transaction is communicated to the shuttle service operator. Richard’s identity does not have to be communicated.

Elena

Cristina bought a paper flight ticket for her aunt, Elena, at a travel agency, and she now drives her to the airport with the help of the GPS and the car’s computer, which is equipped with a telematics module. Cristina subscribes to a vehicle safety and efficiency service which is available to all cars equipped with telematics modules. The service automatically selects the optimal route based on Cristina’s current location (which is determined intelligent sensors in her car and information from other sensors, which are part of the road infrastructure), traffic conditions and local weather information communicated by the service, and they arrive at the airport on time. Airport staff, city administration and private companies share and co-ordinate traffic data in order to minimise potential disruptions on roads to the airport. The subscribed service differs from the one in Richard’s case, where communication is only between the car and nearby/passing RSUs, in that Cristina’s car has a constant connection to the service which in turn communicates with all RSUs on the way to the airport and receives data from sensor on cars (along the route) subscribed to the service. Thus, it allows Cristina to receive much earlier information about a car accident, road work, traffic congestion etc that are farther ahead (than receiving it from a nearby RSU). While the traffic information is being downloaded in real time and displayed on the local map, Cristina’s approximate physical location is revealed to both the cell communication provider as well as the navigation service that provides the map and traffic conditions applications. Cristina has subscribed to a location-based service, and she earns points when she uses specific facilities and services, such as the airport parking lot, or when she buys from a specific store. So, upon entering the airport access road, the automobile’s licence plate number is captured by the digital video camera and a record is kept. The record of the car plate number entering the airport premises with time stamp is stored in the airport security control system. The record is used by the airport for traffic pattern and visitor demographic analysis. It is also retained for a year for the need of potential future law enforcement investigations. However, the airport had also been previously approached by commercial establishments (e.g. rental car company) on the availability of the data for market analysis. The LBS invites Cristina to use a specific airport parking and when she accepts, the garage parking assistance application guides her to the specific lot. Since she is really late for a business meeting, Cristina walks Elena to the departures main entrance, from where Elena, quite clueless and not speaking the local language, must find her own way in the airport.

Flying 2.0 – Enabling automated air travel by identifying and addressing the challenges of IoT & RFID technology

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Akira

As a Japanese citizen, Akira benefits from the registered traveller program agreed between the European Union and several countries, one of which is Japan.

Akira has filled out, 24 hours in advance, his PNR form online which was then reconciled with his Global Entry registration data by the Ministry of Interior in London. He has not checked-in online.

As Akira is keen on French perfumes as gifts and since he finds they are less expensive to purchase in Europe, he has bought via the airline’s website a few samples of Hermès and Chanel perfumes for his family and friends.

Following Akira’s order, the airline’s online shop personnel will then tag the bottles with RFID tags indicating that Akira is the rightful owner of these bottles, based on his ticket reservation and frequent flyer number. All items bought will then be loaded onto the correct airplane based on his boarding pass information, which Akira acquires in the airport when he checks in. He will receive the bottles from the airline’s personnel later on when he is comfortably sitting on the plane by waiving his boarding pass in front of a specific reader.

Akira goes to the airport by London Underground. He carries a Japan JR East (East Japan Railroad Company) Suica (Super Urban Intelligent Card) RFID card which he often uses not just for commuting in Tokyo, but also for purchasing smaller items such as meals. Although the Suica card is in principle not interoperable with the London Transport system, it can be used to purchase credit from London Transport. Akira presents the Suica card to the London Underground kiosk and chooses an amount of credit he would like to purchase. From this moment, his Suica card will be able to simulate an anonymous Oyster card [See Assumption No 10]. If he doesn’t use the London Transport system for more than three months, unused credit will be automatically returned to his e-wallet.

The Transport for London (TfL) system maintains a record of Akira’s purchase. Since his card simulates an anonymous Oyster card, TfL only retains the amount of his credit and not his personal data.

C. On location: the three arrive at the airport and prepare to fly

Richard

A location-based service (LBS) informs German Air (GA) of Richard’s arrival at the airport. Since Richard is an Elite frequent flyer member, GA sends him helpful service information such as flight status, information about the frequent flyer lounge and the shortest queue selection to the restricted zone. He uses his smart phone with the received token during check-in in combination with the smart phone’s near field communications (NFC) capability to gain access to the restricted zone. He also has to put his finger on a reader which reads his fingerprint and confirms that the token is issued to him. If his phone were to be stolen, the token would not be usable without his fingerprints. A call to the DCS is

Flying 2.0 – Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 13 13 13 13 13 13 13

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

initiated and as he is checked in to travel on the GA flight to Atlanta, he is allowed to enter. Since Richard is travelling outside the Schengen area, he needs to undergo the automated passport/immigration control. He proceeds to a border control booth and presents his passport to the scanner to activate the authentication process. The passport reader verifies his passport. Access is authorised after the automated passport/immigration control system accesses the German Passenger Information Unit (PIU), which delivers an electronic travel authorisation (ETA), based on clearing his PNR data. The system then verifies that one person is in the booth. Once these tasks have been carried out, a door opens to give access to the security control zone.

Richard passes through the security check zone and can then enjoy various airport facilities, such as connecting to the GA Elite Frequent Flyer free Wi-Fi network. When he buys goods from duty free shops, he confirms his flight by communicating his token through NFC or displaying it as a 2D barcode, where NFC is not available.

While Richard is browsing, the LBS enables a neighbouring duty-free shop to identify Richard’s presence (see assumption 15). The shop recommends that he have a look at a collection of silk scarves. Richard has already subscribed to a new service for receiving ads when new accessories are available in a shop, such as scarves, which would make a wonderful gift for his wife, Helen. Richard visits the store and buys two scarves for her.

Richard feels hungry and as he goes by a pastry stand, his smart phone, sharing his preferences with the shop, tells him which sandwiches fit his needs and dietary recommendations.

While picking up the sandwich, the Electronic Product Code (EPC) on the wrapping communicates with his smart phone regarding information on this item – when it was made (freshness date), travel history (where it was made and how it got to the airport), temperature history (not spoiled), pricing history (it was marked down for sale) and, more importantly, nutrition information, and potential health benefits and risks. This is compared to a diet plan defined by the diabetes service and, based on his current blood sugar level, the service makes a recommendation to Richard. The RFID chip does not allow Richard’s smart phone to alter the item information since the chip only permits alteration by the authenticated and authorised pastry stand reader which is authorised to change only certain data such as price. However, the fact that Richard has purchased this item is also recorded by the shelf readers. This information is collected for marketing analysis, as well as for operational efficiency improvement. As Richard did not ask to leave information on RFID, the tag is by default permanently disabled at

the counter, to prevent customer’s privacy

As Richard spends too much time in the duty free zone, he receives a message from GA on his smart device calling him to the boarding area.

Flying 2.0 – Enabling automated air travel by identifying and addressing the challenges of IoT & RFID technology

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Richard rushes off to the gate to board.

He communicates his checked-in booking token to a reader through NFC, which again accesses the DCS and confirms his registration on the given flight. He then authenticates himself following the same procedure as in the passport check.

Elena

As Elena travels to Madrid, which is located within the Schengen zone, her departure procedure is simpler than Richard’s, however since she is not that IT-friendly, it seems somewhat challenging to her.

As soon as she enters the airport, Elena approaches an information kiosk to ask for more information on how to proceed next. As she doesn’t speak or understand English very well, the clerk gives her a visual interface device which is location sensitive, with voice instructions in all EU languages. Elena selects the Spanish language and follows the instructions of the device towards a manned check-in desk to drop her luggage and collect the boarding pass, including the luggage tag receipt. At the checkin counter, the clerk asks her for the visual interface device and inserts as final destination the gate from which Elena should board and initiate the DCS. The device will provide her visual information on her location inside the airport and the route she needs to take in order to proceed to the gate to board, and will alert her when the boarding actually starts. The clerk also instructs her, with a lot of body language, that she will need to return the device to an assistant at the boarding counter, and tries to make sure that she knows how to use it. As the device is really user friendly (the same model is given to all unaccompanied minors and elderly passengers, in addition to personal escort by a clerk), this is not a problem for Elena.

Her boarding pass is encoded in a 2D barcode. The clerk asks Elena to put one of her fingers on a scanner, which registers her fingerprint features and encodes its subset in a 2D barcode together with boarding information. This prevents Elena’s boarding pass from being used by another person.

Using the handset, Elena proceeds to the security check, and once in the boarding area she follows the instructions on the display until she arrives to her gate. Once there she confirms on the screens that she is in the right place and that the plane does indeed go to Madrid, but she also sees that she has plenty of time and then decides to venture the shopping area. In the end she spends so much time browsing the shops, that she is alerted by the handset that her flight has started boarding, and she rushes back to the gate. Once there she joins the queue to board the plane and when she presents her boarding pass she is reminded by the clerk to return the handset, which she does. It will later be returned to the information desks at the departures lounge so that it may be used by other passengers like Elena.

Akira

As Akira has not checked in yet, he approaches a kiosk in the departure terminal of the airport to check in. He owns a smart phone device, but since it is not 100 per cent compatible yet with the European check-in procedures, he prefers to use his Nihon Airlines RFID frequent-flyer card. He presents his RFID-

Flying 2.0 – Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 15 15 15 15 15 15 15

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

tagged frequent flyer card to one of the designated RFID readers. He is also asked to put one of his fingers on the scanner, which compares it with fingerprint features stored on frequent flyer card (which prevent Akira’s boarding pass from being used by another person). The reader sends information about the flight, seat number, etc. to the frequent flyer card. Now Akira can use his card as a boarding pass.

When he displays his card to the reader, the DCS is initiated in order to confirm he is indeed booked on the Nihon Airlines flight to Tokyo Narita. At the same time, it updates the Passenger Information Unit (PIU) at the Ministry of Interior, which delivers an electronic travel authorisation (ETA), based on the processing of his PNR. An ETA is not delivered if a passenger has overstayed his visa period. Confirmation that Akira is checked-in for a flight allows him to enter the restricted area.

After checking Akira’s identity, the scanner erases his fingerprint data immediately from its memory (see Assumption 16). The kiosk calls Nihon Airlines’ departure control system, which confirms that he has checked in and is registered on the flight to Tokyo. As Akira likes cutting-edge technology, he owns a suitcase with an embedded RFID tag. At the selfcheck in kiosk, and upon confirmation of his ID, the machine also adds Akira's flight details to the RFID tag embedded in his suitcase. The luggage tag receipt is then stored on his frequent flyer card. Akira can then drop off his suitcase at the nearest baggage drop.

Akira then proceeds to the restricted zone, which he enters by waiving his frequent flyer card in front of the RFID reader and swiping his finger on the scanner to confirm that the card which now contains his boarding pass belongs to him.

As he is travelling outside the Schengen area and Japan has agreed on a registered traveller scheme with the EU [see Assumption 3], he is directed to an automated passport/immigration control. This scheme operates on the basis that governmental agreement has been reached between the EU, member states and other countries where respective travellers can register on schemes facilitating easier travel in relation to visa requirements. The system requires biometric enrolment and data sharing between members. Airlines are required to check whether travellers are registered on the scheme, but do not have access to the database. No-fly’s or visa related problems continue to be dealt with border control authorities upon checking of the travellers’ visa.

He passes passport control in the same way as Richard, but additionally he is asked to present his Schengen visa to the scanner. The biometric data from the visa are checked to verify that he is the rightful owner [see Assumption 18]. In the first attempt, identification fails and Akira needs to run his biometrics through the scanner again. He is a bit frustrated and anxious that something has gone wrong, but he is successful the second time. The system then verifies that he has not overstayed his time in Europe permitted by his visa according to the Entry Exit procedure of the Visa Information System (VIS).

After passing the security check, he can enjoy the various facilities of the airport, he ordered from the

Flying 2.0 – Enabling automated air travel by identifying and addressing the challenges of IoT & RFID technology

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

airport duty free website. If a complementary check is needed, he displays his RFID boarding pass.

After lingering in the duty free area, Akira proceeds to his gate. He is registered on a Japanese professional network site (JP-professionals-unite.com) and is interested in making new connections with architects and interior designers, since he will be looking for a job as soon as he is back in Japan. At the boarding gate, the application on the smart phone detects that there is an architect from the company Tokyo Architects Ltd waiting to board the same plane. Akira eagerly initiates the conversation, the other accepts and they start discussing. After some time, they both consent to reveal their physical locations at the boarding gate and continue the conversation face-to-face. The usual boring wait at the boarding gate has suddenly transformed into an interesting discussion of potential benefit to Akira.

D. Airborne

Richard

Even though Richard’s health problems mean he has a slight risk of seizure due to the combined complications of diseases and high altitude, fortunately, German Air is equipped for “physically challenged passengers”. The aircraft has special seats embedded with pressure and temperature sensors, which allow such passengers to be unobtrusively monitored for early warnings such as lack of movement or agitated movement during long flights. Richard’s doctor had requested such an arrangement and Richard is so accommodated. These special seats are also able to communicate with Richards’ body sensor network for better warnings.

GA knows of his medical condition. In addition to the seat sensors, Richard’s body network periodically transmits his vital signs over the aircraft’s wireless network. German Air uses its aircraft communication channel to relay these very low bandwidth but critical data to ground for continuous monitoring of physically challenged passengers.

Once the aircraft has reached its cruising altitude, Richard turns on his netbook computer and connects to the Internet using the “Internet in the air” programme, a service offered to business-class passengers. The operating system establishes an encrypted virtual private network (VPN) channel back to his company, enabling Richard to complete some work securely.

Elena

Elena’s smart ‘allergy bracelet’ informs her about food that is not compatible with her rice gluten allergy. When snacks are distributed shortly after taking off, the flight attendant hands her a bag of pretzels with an RFID chip imprinted on the bag, which contains detailed ingredient information, as well the production date and information about the manufacturer. Elena’s allergy bracelet recognizes the rice gluten content via communication with the EPC chip and alerts her by vibrating/flashing; it is also supposed to deliver a SMS on her phone and/or an alert through the Bluetooth connection;

Flying 2.0 – Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 17 17 17 17 17 17 17

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

however, Elena has her phone switched off, and the alert fails to be delivered. Elena chooses to ignore the vibration: the bracelet many times has vibrated even if the food was OK for her to eat, and she is rather annoyed with it. She does however decline the snack, because she does not feel like eating pretzels. The flight attendant offers her some fresh fruit as an alternative.

In the second hour of flight she tries to read a book from the e-book reader available from the seat, which is another entertainment feature that airlines have introduced. As the flight is heading to Spain, it includes several titles in Spanish, and Elena selects one and tries the device for the first time. Intuitive multi-touch interface makes it very easy to use and thanks to e-paper technology Elena feels like reading a paper book. But after some time she is tired of reading, so she plugs in her headsets and turns on the text-to-speech function.

Akira

Akira is very excited and the flight from Heathrow to Narita is long. Upon reaching the cruising altitude, Akira turns on his notebook which doubles as an Internet and video multi-media device and starts searching. After a bit of exploration, Akira discovers a small group of about 15 passengers forming a peer-to-peer ad-hoc network. Akira also connects to the Nihon Airline’s flight entertainment system’s free movie section and browses the movies but cannot find anything that he likes. However, he does find a couple of interesting documentary films published under Creative Commons, about travels to South America which a fellow passenger shares on his video server. Akira spends some enjoyable hours viewing these. Akira reciprocates with some of the content and services on his notebook.

Akira also uses his notebook to select a Japanese dinner from the Nihon Airlines in-flight service menu website. There is no more of the boring “Chicken or beef?” which used to be the only alternatives of only a few years ago. Now the flight attendant brings exactly what he wants with all the right trimmings and drinks.

As Akira had earlier bought the perfumes from the airline’s online store, the in-flight personnel matches the goods to Akira based on the RFID tags, and brings the goods to his seat whereupon he introduces his boarding pass to a reader, is identified and receives the perfumes. As an afterthought, he connects to the in-flight duty free shopping menu from his notebook and decides to buy a heavily discounted Swiss watch. The visa confirmation system is activated to confirm that his card is not stolen or invalid. He is then asked to select the delivery address: after pondering on whether to pick it up from the arrival airport, Akira finally selects the option “remote delivery” and fills in his girlfriend’s address in Osaka. He smiles as he pictures the happily surprised face of his girlfriend.

E. Arrival

Richard

The luggage service ordered by Richard includes delivery of all checked-in luggage at his home in Atlanta. Therefore, Richard can directly proceed from the arrival gate to the terminal hall. As a US

Flying 2.0 – Enabling automated air travel by identifying and addressing the challenges of IoT & RFID technology

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

citizen, he does not even have to go through the immigration control.

Helen, Richard’s wife, is going to pick him up at the Atlanta airport. Her high-priced, Italian purse has an embedded scheduler that helps her to keep track of little life chores like this since Helen thinks it’s a little beneath a lady to carry with her a hard and unfashionable object like a smart PDA. Her idea of class is high fashion combined with embedded computation power and connectivity. As such, Helen’s purse constantly checks on German Air’s flight status over the course of the day, informs her of the three hours’ delay and eventually reminds her to leave home 45 minutes before the touch down time.

Once on the way, her car computer takes over tracking Richard from the purse. The car reports Richard’s disembarkation status visually from de-planning, luggage claim, immigration, customs, and finally walking toward the arrival hall. Thanks to the car navigation system that adjusts car speed based on Richard’s progress, Helen reaches the exact sidewalk pick-up location 15 seconds before Richard steps out of the door, as usual.

Richard’s return, Helen’s trip to pick him up, her fine taste for top Italian designers and expensive cars are all noted by the ISP and LBS service provider.

Elena

Elena is now in familiar ground, and even if she is not a frequent traveller, she can easily find her way around the Madrid airport. She proceeds from the arrival gate to the terminal hall carrying her hand luggage and she turns on her mobile phone on the way. Immediately she receives an SMS asking if she needs a taxi, and as she feels tired, she decides to accept the offer and replies “YES”. When she confirms, the request is transmitted to the LBS operator and the taxi company receives her GSM-based coordinates. In two minutes, while she proceeds to the terminal, she receives from her multi-media messaging service (MMS) a photo of the car which is waiting 30 m from her.

The taxi service gets Elena’s location from LBS operator based on her consent. The record of her SMS must be kept by taxi service as a proof that her coordinates were retrieved for her request.

Technology: Multi-lateration in the GSM network.

Akira

Akira arrives at Tokyo airport and proceeds from the arrival gate to the luggage reclaim. As a novelty, the luggage reclaim system at Tokyo airport does not use luggage belts, but luggage reclaim stations, where an automated system returns all pieces of luggage exactly to their owners upon request. Akira

Flying 2.0 – Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 19 19 19 19 19 19 19

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

approaches such a station and presents to a reader his frequent flyer card, which contains his luggage tags receipt. The data read from the boarding pass allows identification of the pieces of luggage Akira had checked in. Within few seconds the system automatically moves them to the appropriate reclaim station, where Akira can pick them up.

As Akira moves away from the reclaim station, where he has just picked up his luggage he receives a “Syai Nain” message from the “Hazukashi Nain” (Shy Not), a well-established Japanese online dating service, to which Akira has been subscribed for quite some time. The service is strategically integrated with the LBS service of Narita airport; Akira reads the following message:

“Dear Akira-san, welcome back. We hope you had a good journey. It is our greatest pleasure to offer you this opportunity to meet Sakura-san, a young lady of exceptionally fine matching attributes based on your “Happy Friends” social network profile. Sakura-san is not far from your current physical location and is willing to communicate with you. Please push this button for an instant audio/video connection.”

Akira is irritated, since he no longer wishes to receive such invitations. He realises that he hasn’t updated his profile, and makes a mental note to deal with it later: perhaps he would need to unsubscribe completely from the service. For the time being, he wisely clicks on the “ignore” button and moves on.

Assumptions

[any assumptions made while writing the scenario flow. The assumptions’ field is a place holder for information that may concern generic information about relevant legislation, devices, applications,

participants, etc.]

1. As the time frame of this scenario is five years into the future, we assume that the DG JLS will have already implemented a Global Entry program (in the form currently set out in policy documents) this is assumed to have two components: - A registered traveller (RT) system is implemented between EU and third countries including the US, Canada, Japan based on a prior enrolment of frequent travellers (e.g., Richard) - Non-EU citizens (e.g., Akira) are registered at their port of entry into the Schengen area to make sure that they do not overstay the permitted visa period.

2. As the ban on liquids and gels (LAGs) is currently under discussion, passengers may no longer undergo physical searches and confiscations of bottles. At any rate, in the context of the next five years, it is assumed that automated IT devices will be used for both detecting LAGs and identifying prohibited items. The two following technologies/applications are being considered: - Body scanners: it is assumed that objections raised over these devices, by the European Parliament and others, may have been somewhat subdued in view of automating the procedure and prohibiting the generation of raw images. The automated procedure will automatically inform security personnel when prohibited items are detected. After the recent attempted bombing of a flight bound for Detroit (December 2009), the body scanners have been deployed in a number of

Flying 2.0 – Enabling automated air travel by identifying and addressing the challenges of IoT & RFID technology

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

UK airports as well as in Schiphol itself. The legality and permanence of this deployment is unknown. But we can safely anticipate that the passenger will at least be given the choice between undergoing physical searches or passing through a detection equipment. - Smart corridors.

3. DG JLS is planning a registered traveller programme as a subset of its Entry / Exit project (http://www.exodusnetwork.org/modules.php?op=modload&name=News&file=article&sid=2002). It is supposed to replace the current RT programs running in Europe on proprietary systems. Even though Frankfurt now has its own (proprietary) system, in our scenario however, we do not refer to this specific system. In our scenario, we consider a registered traveller program that has been agreed by the following countries: EU Member States, US, Canada, New Zealand, Japan and South Korea, which will allow travellers automated border control at both departure and arrival. Citizens can enrol either in their home countries or countries at their location of residence.

4. In the context of the current scenario, we consider a seamless boarding process that will allow effective and secure passenger management based on the same system that is used at the checkin stage, namely verifying the 2D barcodes, tokens and biometrically authenticating the passengers to prevent boarding pass exchanges.

5. PNR is not needed for EU citizens that fly within the EEC.

6. The cost of IoT devices such as RFID tags, readers, sensors, and airport/garage wireless infrastructure becomes low enough so that the deployment and operation of such future air travel environment is cost effective from the business and consumer perspectives.

7. The computation power, storage and communication bandwidth capability of various IoT devices continue to advance rapidly.

8. Necessary standards in communication protocols, integration architectures (e.g. Service Oriented Architecture – SOA), and business processes (air travel) continue to evolve and be defined.

9. Social and culture acceptance of integration of pervasive IoT devices into daily personal life continues to grow strongly.

10. In 2015, there is still no interoperability between transportation systems of different cities of the world (with only several exceptions). Akira uses his Suica card as an e-wallet to purchase Oyster credit, but in fact there is no information exchange between these two transport systems. If Akira wanted to buy a personalised Oyster card (which allows for more services then the anonymous one), he couldn’t use his Suica card (it is needed to fill in a form, etc)

11. Airports considered in the scenario support both automated and manual procedures for check-in and boarding.

12. Identity management systems are in use to protect passenger’s privacy, and not reveal information, e.g., regarding a passenger’s location, etc; however, the adequacy of these systems is not assumed

13. In certain situations in the scenario, pseudonymous data / identifiers (regarding users’ preferences and location) are communicated to services, e.g., when Richard is browsing and an LBS enables a neighbouring shop to identify his presence. Again, the adequacy of such a control is not assumed.

14. In the case of access to the ad-hoc network on the plane, the passengers have an option to share certain documents/directories with other passengers. They can also define an obligation that those who access their content have to share something in return. A digital rights management

Flying 2.0 – Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 21 21 21 21 21 21 21

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

system is in place to ensure that the user’s video is shared only with fellow passengers who cannot further disclose or copy it.

15. The LBS service is shielding Richard’s identity and preferences, so that it is not directly disclosed to the shop, i.e. Richard’s device authenticates to the shop using a pseudonym obtained from the LBS server that is linked to his preferences.

16. When Akira checks-in with his RFID-tagged frequent flyer card (which also contains his fingerprints), Akira’s fingerprint is used for authentication only: it is already stored at his frequent flyer card, so the airline company has already the fingerprint and can store it in the database.

17. When registering as a frequent flyer member, Richard registered his fingerprints to the airline. Since he is a frequent flyer member of that airline, it is highly possible that his fingerprint is stored by the airline and when the token is issued, it is encoded with his fingerprint preventing someone else from using his token (boarding pass). This could be a requirement from the airline that only registered members (who have registered their fingerprint) can download the token online.

18. The biometrics authentication against the chip in the visa is performed for non-Schengen travellers (in the case of Richard and Akira), and there is no access to the central database at this stage (SIS II). At any rate, specific details on passport and visa authentication fall outside of the scope of this assessment and will not be considered or assessed; they are only presented here for completion purposes.

Framing the scenario

Timeframe 2015

[when the scenario takes place]

Location Home, office, en-route to airport, departure airport, onboard the airplane, [where: Home / arrival airport

work / public space...]

Actors  Passengers: Richard, Elena, Akira [who: entities  Elena’s niece: Cristina relevant to the  Richard’s wife: Helen scenario and  Airport shuttle: Diamond Airport Shuttle describe their roles  Communication service provider and goals. These  London Transport most include  Airport pastry stand operator humans and  Airline check-in agent organisations but  Airline boarding agent not IT systems.]  Airport security check point police  Border/passport control official

Flying 2.0 – Enabling automated air travel by identifying and addressing the challenges of IoT & RFID technology

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

 Luggage pick-up and delivery service provider  Richard's Doctor  CCTV operators [traffic, airport], i.e., CCTV's providing traffic information, may be private or public, obviously city authorities in the airport will have an interest in traffic flows, as much as private operators providing commercial services  Customs officials [in case prohibited items in terms of duty and excise regulations are detected]  Other passengers on flights  Airport operators

Technologies /  PDAs & smart devices/phones  RFID tags

devices

 Mobile phone positioning (cell identification, multilateration, triangulation)

[technologies /

 2D barcodes (BCBP – bar-coded boarding pass): The IATA standard uses

devices used in the

scenario] existing codes such as Aztec and Datamatrix which are used extensively in Europe and North America. Both are proven technologies and can be read by a single scanner which is cost effective and readily available globally  NFC (Near Field Communication) [see footnote 6]  Global Navigation Satellite System (GNSS)  4G cellular wireless and Wi-Fi IEEE 802.11-wireless LAN or ad-hoc network (Network, car2car communication or vehicle-to-roadside communication, DSRC, etc.) or infrastructure mode  Authentication via biometrics (fingerprint, iris scan and facial recognition)  Body area network  Seats with embedded pressure, temperature sensors (En-route passenger health monitoring)  Automatic image and video analysis (including prohibited items detection)  Liquid and gels detection

The following devices or objects are available for passenger use and could implement a subset of previous technologies:  IoT smart devices (smart phones, etc)  National identity cards with embedded and encrypted biometric features  Electronic passports with embedded and encrypted biometric features  RFID enabled frequent traveller cards  VISA card (for online purchases)  Handset devices with multilingual support (RFID-tagged airport concessions merchandise)  RFID-tagged en-route food/snack items Applications  Web-based application: “WhereToGo” [applications used in  Airport parking application: Frankfurt Garage Assistance the scenario]  Automated traffic management  Immigration/border control databases

Flying 2.0 – Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 23 23 23 23 23 23 23

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

 Airline baggage tracking application  Digital video camera and automated video analysis  Steady LBS targeted advertising application  Steady-sugar-level diabetes monitoring  “Hazukashi Nain” (Shy Not) Japanese online dating service Data  Identification information [information that is  Biometric data: facial information, fingerprints collected, or flows  ID numbers through the  Passport number network, or is being  Visa-related information stored and further  Frequent flyer numbers processed]  Shopping habits, spending patterns and preferences  Dietary habits  Financial credibility  Health data (blood sugar level, temperature and movement in the airplane)  Personal data (e.g. name, age, nationality, credit card, IoT smart device, software and hardware models)  Location / geographic data  Personal travel itinerary  Personal consumer habits (e.g., merchandise perusing history, purchase record, and gift-buying patterns)  Luggage data  LBS data  Home videos

Drivers  The state and airlines aim at simplifying the air travel procedures to [key drivers behind facilitate air travel for citizens the scenario: socio-  Airlines, airports, vendors and service providers at the airport are driven by economic, political, an organisational imperative to improve their operational efficiency and environmental or customer experience and to generate new business opportunities in order personal to earn more revenues and profits motivation...]  The state, but also airlines, airports, and other service providers are driven by a wish to maximise security (cost-effectively, of course)  Passengers are driven by a desire for an agreeable, comfortable, fast, efficient, hassle-free travel experience, preferably at the lowest possible cost. Some passengers may be driven by health concerns.

Flying 2.0 – Enabling automated air travel by identifying and addressing the challenges of IoT & RFID technology

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

Glossary / Aid

ACI Airport Council International BCBP Bar Coded Boarding Pass DCS Departure Control System DG Directorate General DPA Data Protection Authorities EDS Explosive Detection System EPC Electronic Product Code ETA Electronic Travel Authorisation GA German Air GNSS Global Navigation Satellite System (or Service) GPS Global Positioning System IATA International Air Transport Association ICAO International Civil Aviation Organisation IFE In-Flight-Entertainment IOT Internet of Things IPF Ideal Process Flow IS Information System IT Information Technology JLS Justice Liberty and Security LAGs Liquids and Gels LBS Location Based Service MMS Multimedia Messaging Service MRO Maintenance, Repair and Overhaul NFC Near Field Communication PCP Physically Challenged Passenger PDA Personal Digital Assistant PET Privacy Enhancing Technology PIN Personal Identification Number PIU Passenger Information Unit PKI Public Key Infrastructure PNR Passenger Name Record RT Registered Traveller RFID Remote Frequency Identification SIM card Subscriber Identity Module Card SPT Simplifying the Passenger Travel SSD Solid State Drive StB Simplifying the Business SUICA Super Urban Intelligent Card VIS Visa Information System VPN Virtual Private Network

Flying 2.0 – Enabling automated air travel by identifying and addressing the

challenges of IoT & RFID technology 25 25 25 25 25 25 25

Annex I – Scenario Building & Analysis Template

Identifying emerging and future risks in a future IoT/RFID air travel scenario

References

Adey, Peter, “Secured and Sorted Mobilities: Examples from the Airport”, Surveillance & Society, Vol. 1, No. 4, pp. 500-519. http://www.surveillance-and-society.org

Bachelor, Lisa, “Ryanair scraps airport check-in”, The Guardian, 14 May 2009. http://www.guardian.co.uk/money/2009/may/14/ryanair-online-check-in

Bowcott, Owen, “Face scans for air passengers to begin in UK this summer”, The Guardian, 25 Apr 2008. http://www.guardian.co.uk/business/2008/apr/25/theairlineindustry.transport

Estrin, Deborah (ed.), Embedded, Everywhere: A Research Agenda for Networked Systems of Embedded Computers, Committee on Networked Systems of Embedded Computers, National Research Council, National Academy Press, Washington, D.C., 2001. http://www.nap.edu/openbook.php?isbn=0309075688

European Council, Regulation EC 2252/2004 of 13 December 2004 on standards for security features and biometrics in passports and travel documents issued by Member States, OJ L385/1, 29.12.2004

European Group on Ethics and Science in New Technologies (EGE), “Ethical Aspects of ICT Implants in the Human Body”, Opinion to the Commission, 16 March 2005. http://europa.eu/comm/european_group_ethics/docs/avis20en.pdf

Michaels, Daniel, and Andy Pasztor, “Lufthansa to Upgrade to Better Wireless Connections”, The Wall St Journal, 12 Oct 2009. http://online.wsj.com/article/SB10001424052748703790404574467072334949300.html?mod=google news_wsj

Miller, Claire Cain, “It Knows Where You Are, and What You’re Looking For”, The New York Times, 2 Nov 2009. http://www.nytimes.com/2009/11/03/technology/internet/03local.html?_r=1&ref=technology

Modinis Study on identity Management in eGovernment, Study prepared for the eGovernment Unit, DG Information Society and Media, November 2005

Page, Lewis, “Interpol proposes world face-recognition database”, The Register, 20 Oct 2008. http://www.theregister.co.uk/2008/10/20/interpol_face_scan_plan/

Scott, Jennifer, “Heathrow rolling out facial recognition tech”, ITPro, 30 Nov 2009. http://www.itpro.co.uk/618298/heathrow-rolling-out-facial-recognition-tech