Hugh

More joy about "secure" databases
Charlie's Diary 17th March 2008

"Take two news items about the same subject:
Firstly: MI5 want to data mine the Transport for London Oyster card database: "The Observer said this weekend that the Information Commissioner's Office (ICO) has confirmed that the clandestine services have requested full Oyster access, and would target other cities' smartcard travel schemes as they come online. At present they can request details of an Oyster user's transactions - and hence, time-slugged locations - on an individual basis only, rather than having free rein to search the system as they please. This could include mining the entire database to look for suspicious patterns, and tracking named individuals."

Secondly: Wireless subway cards cracked: "Karsten Nohl, a computer science researcher at the University of Virginia, claims to have broken the encryption used by the RFID (radio frequency identification) chip found in the Charlie Card on the Boston T subway system and in the Oyster Card on the London Underground.".....

.....Now. If you were a miffed anti-authoritarian prankster — and you knew the Thought Police would be looking for suspicious patterns of travel in a database, and if the data going into the database was amenable to hacking (if, for example, you could run off fake Oyster cards in the name of, say, Sir Ian Blair), wouldn't it be fun to see if you could make the Security Elephant dance? Mark Thomas fans, I'm looking at you.

Alternatively, if you were a really smart terrorist, you'd never use the same (fake) Oyster card twice"