IEEE Spectrum March, 2007 - 18

How to get
Chipped
ImPlantatIOn Is nOt fOr EVEryOnE,	
but	if	you're	determined	to	do	it,	here's	
what	I	recommend.	before	implanting	
a	radio-frequency	identification	tag	in	
your	hand,	know	how	you	plan	to	use	it.	
the	tags	cost	about	uS	$2	each,	but	you	
will	spend	between	$30	and	$600	for	a	
reader.	remember	to	factor	in	the	fee	for	
a	standard	doctor's	office	visit	into	your	
project	budget.
Is	the	extra	security	of	more	sophisticated	tags,	like	a	philips	hitag	2048	S,	

worth	the	cost	of	the	$400	rfId	readers	
they	work	with?	or	might	simpler	
	readers	meet	your	needs?	check	out	
the	rfId	implants	and	implant	security	
forums	at	http://tagged.kaos.gen.nz	and	
at	my	Web	site,	http://www.rfidtoys.net,	

to	see	what	others	have	wanted	to	know.	
A	simple	Web	search	will	turn	up	links	
to	numerous	rfId	equipment	vendors.	
once	you've	found	your	tag,	buy	a	
couple	and	test	them.	find	out	from	the	
manufacturer	whether	your	tag	is	safe	for	
implantation	and	make	sure	it	works	with	
the	reader	you	choose.
ready	to	get	implanted?	you	have	
two	options.	A	surgical	implant	takes	
about	5	minutes,	or	you	can	buy	an	
injection	kit.	the	scar	from	an	injection	is	smaller	and	heals	faster,	and	
the	procedure	lasts	about	30	seconds.	
I	bought	my	kit	from	a	local	pig	farmer,	
but	Avid's	single-use	dispenser	kits	
are	available	online	for	$12	to	$20	
apiece.	those	come	preloaded	with	
an	animal	implant	tag,	which	you	will	
need	to	replace.	the	syringes	require	
a	2-	by	12-millimeter	tag,	so	larger	tags	

AMAl	GrAAfStrA	(3)

doctor and scheduled the procedure. Despite a fear of needles-
and a brief fainting spell-Jennifer had her hand numbed and
the implant injected; 5 minutes later she was ready to swipe
open doors herself. I'm pretty sure we are the first couple to get
his-and-her RFID implants.
Perhaps a bit belatedly, I began to wonder about the security
of these devices and conducted some tests. It turned out that
others were also investigating this subject. Jonathan Westhues,
a Cambridge, Mass.-based electrical engineer, built an RFID
"cloner" device that, when held within inches of the targeted tag,
can digitally record and play back the analog radio signal that is
emitted by various types of tags, including VeriChip implants and
EM4102 tags. A team at Johns Hopkins University, in Baltimore,
cracked the encryption used in ExxonMobil's Speedpass, an
RFID-based payment system, and then showed how to clone a
Speedpass tag and buy gasoline.
I decided to get my second implant, a Philips Hitag 2048 S
tag, to address some of my concerns. The $4 tag, which has
40-bit crypto-security features and 2048 bits of read/write datastorage capacity, was implanted by my family doctor using the
same kind of implant needle used with pets, which is basically
a syringe loaded with a tag. It operates at 134 kHz and has the
same 5-cm read range as the EM4102.
The protected data storage area of this tag holds randomly
assigned keys that change each time they are used, so the key
can't be easily defeated by cloners. And it can't be decrypted,
either-at least not by the Johns Hopkins method, because
its encryption is more robust. Another advantage is that the

www.spectrum.ieee.org			

would	have	to	be	inserted	surgically.	
When	you	suggest	the	procedure	to	
your	family	doctor,	be	prepared	to	discuss	
the	safety	of	rfId	tags	and	offer	to	sign	
a	liability	waiver.	If	your	family	doctor	is	
reluctant	to	do	it,	ask	a	cosmetic	surgeon.	
failing	that,	if	you're	really	determined,	try	
a	body-piercing	shop.	
once	the	procedure	is	about	to	take	
place,	remember	you	probably	need	to	
	sterilize	your	tag.	don't	let	your	doctor	use	
an	autoclave	to	sterilize	the	tag,	because	
the	heat	will	destroy	it.	Soaking	it	in	a	liquid	
disinfectant	like	alcohol	should	do	the	trick.
for	tips	on	how	to	make	your	world	
rfId-accessible,	check	out	my	book,	RFID
Toys	(John	Wiley	&	Sons,	2006).	you	can	
find	some	free	tips	on	hacking	your	front	
door	at	my	Web	site.		
-A.G.

Philips tags are not used in the kinds of business scenarios where
attacks are common. My encryption keys are not widely distributed, as they would be for a business, so the attack would have
to be targeted directly at me, and attackers would not have the
luxury of testing multiple keys. Rather than going to the trouble
of chaining together a bunch of field-programmable gate arrays
and writing the code to make it all work, as the Johns Hopkins
team did, it'd be far easier to just kick in my door.
The only downside to the Hitag is that the reader hardware
that supports these enhanced features costs around $400. The
speed at which the tag can be read is slowed down to several
times a second by the back-and-forth communication required
between the reader and the tag. Compared with the EM4102,
which can be read well over 100 times a second, this tag's read
speed is glacial, but it is still fine for my needs.
For the time being, this is as far as my RFID lifestyle goes.
Since the initial days of my first implant over two years ago,
the number of do-it-yourself RFID taggers has grown to include
hundreds of people worldwide. While I may want to upgrade one
of my implants one day, for now I'm happy to just observe how
others develop this trend.
n

About	thE	Author
AMAl	 GrAAfStrA	 is	 an	 entrepreneur	 based	 in	 bellingham,	
Wash.	his	latest	venture	is	txtGroups,	a	mobile	messaging	company.	he	moderates	a	forum	for	rfId	hobbyists	at	http://www.	
rfidtoys.net.	his	book,	RFID Toys,	provides	step-by-step	instructions	
on	how	to	build	rfId	projects.	
March	2007	|	IEEE	Spectrum	|	NA							23
http://tagged.kaos.gen.nz http://www.rfidtoys.net http://www http://www.rfidtoys.net http://www.spectrum.ieee.org
Table of Contents for the Digital Edition of IEEE Spectrum March, 2007
