The electronic future of the Charlie Card

With very little publicity or public debate, the MBTA is introducing RFID chips into its transit passes.

Recently the Harvard Gazette website gave us Harvard employees an update on how we'll be getting our MBTA passes in the future:

Among the changes, the MBTA will no longer be distributing the monthly disposable, magnetic-stripe Charlie Ticket to bus and subway users. In its place, the CharlieCard, a reusable and durable plastic card with a computer chip embedded, will be mailed to monthly bus and subway riders in December for use in January. For Harvard affiliates with a recurring monthly MBTA pass order, the CharlieCard will recharge automatically every month until its canceled or the individual leaves the University. The "smart" CharlieCard will last for up to five years, so it should not be thrown away.

The words "computer chip embedded" raised some questions in my mind, so I decided to dig a little.

An article on the informationliberation website tells us that the MBTA will be logging passengers' travel:

The new automated fare system will record where a passenger boards the system and at what time. The system won’t capture any data on the rider’s destination. The information will be archived for a year and a half to two years before it’s erased.

We don't have to worry, though, since "T General Manager Dan Grabauskas, who considers himself a privacy advocate, said the authority will zealously guard personal travel information collected by the CharlieCard system." There is a word for privacy assurances from government officials that aren't backed by a specific statement of actions that legally must be taken. The word is "lie." The "privacy-advocating" MBTA already conducts searches without probable cause of passengers, expelling those who refuse from the station.

Numerous sources on the Web state that the cards will be RFID-based, though I can't find any acknowledgement or denial by the MBTA of this. The Practical Nomad says they'll be RFID-based. Google turns up an article on rfidjournal.com, but it's now members-only. The cached version says:

The Massachusetts Bay Transportation Authority and other transit operators plan to deploy RFID-based fare collection systems in 2004. The technology reduces costs, and customers love the convenience.

Clearly that's not an unbiased source, but just as clearly not the kind of site that invents scare stories about RFID. For the present, I'm assuming it's true.

Since the MBTA has just gone to a great deal of expense (which we'll be paying for in increased fares) to add machines where you must insert your card, it's very hard to understand what legitimate purpose RFID will serve. It opens the possibility of privacy invasion, both by government agencies and by private parties. What information can be read by someone with a completely placed scanner? Does it have openly readable personal information? Anyone who issues an RFID-based personal ID should tell its users that, but the MBTA is telling us nothing. A Google search for "RFID" on mbta.com turns up no hits. (Update: A search on "contactless" yields some hits; thanks to "mkbscratch" on LiveJournal for the hint. This page mentions that you can have "unregistered" Charlie Cards, but I suspect that's not an option for those who get discounted, rechargeable cards from their employers.)

I'm not a fan of tinfoil hats, but a tinfoil wallet is starting to sound like a good idea to me.