NFC Tags: A Tool For Control (Part 1)

Over the last year and a half, I’ve been making silly little art with NFC tags, the little tiny computers that power tap-and-pay credit cards and library book scanners.

For some of my favorite pieces, see my NFC Album Cards and this Pokeball:

In making this art, I’ve been thinking a lot about NFC tags and what they, as a technology, enable. I’ve gotten a lot joy out of making these “NFC Sculptures”, and teaching others to make them, but joy isn’t what they’re normally used for.

No, instead they’re most commonly used for control. NFC tags allow powerful people to control and surveil others’ access to objects and spaces, and in doing so, allows them to create and reinforce social hierarchy.

In this blog post, I want to explore some of the ways this is done, on scales from the personal to the international. In a follow-up post I’ll do a deep dive into how Google specifically uses them to maintain their internal caste-like hierarchy of workers.

But first, for anybody who needs it, here’s a quick primer on NFC tags.

NFC Tag Primer

NFC stands for “Near Field Communication” and is a standard that allows for very short range (< 4cm) wireless communication.

NFC tags themselves are little inert chips, no batteries required. Every credit card, hotel room key, metro card, and office door fob has one of these tags crammed into it. Here’s two examples of what they can look like:

As you’re probably familiar, you use these things by tapping them against some other device, called an NFC Reader. Here’s a line of NFC readers gating access to the New York City Subway:

When the NFC tag is placed near an NFC Reader, the tag receives electricty and uses it to turn on the tiny computer inside the tag. That computer runs some small program which usually just reads some stored data (e.g. a URL or a badge id number) and then sends it back to the NFC Reader.

That NFC Reader is then usually hooked up to an external computer system that will take the data passed from the NFC tag and do something with it, like verifying that an ID has access to some door.

For an office badge door system, the general flow looks something like this:

Credit cards use a more complicated encryption process than normal NFC tags (see the aside below), but they ultimately work the same: tap the card against a reader, pass some information, some real world effect happens (e.g. the subway turnstile opens).

All modern smart phones have hardware to work as both an NFC Tag and Reader, allowing you to use them as an emulated credit card (e.g. to pay for things) or to read another tag (like my Pokeball).

Control vs Joy

As an experiment, I once sat down and tried to list every use of NFC technology I’d experienced in my day-to-day life, living in America. Here they are, breaking them down into two categories, Control and Joy.

Control is for usage that limits people’s access to an object or a place, especially when the people being restricted are under the authority of those doing the restricting.

Joy is for… everything else, really. Here we go!

Control

• Credit Cards, via every store or restaurant that allows you to pay for things by tapping. Especially if they don’t accept cash.
• Public Transit Gates
• Hotel Room Keys
• Building Badge Keys (Office, University, etc)
• Prison Infrastructure
  • I only learned about companies like this recently. Not sure how prevalent they are, but boy do they make me sad.
• Bank ATM vestibules
• Car Toll Transponders
  • technically RFID, not NFC, but eh
• Car keys
  • I’m in favor of car locks, I don’t want my car stolen, but it is still control. We should switch to more public transit anyway…
• Library Book Checkout
  • I love libraries, but the NFC tags still serve as the implementation of a system that tracks what books you check out
• Amiibos
  • They’re fun, but they gate game functionality behind money
• Brick which controls how much you can use your phone.
  • Again, I’m in favor of people limiting their phone use, but you can see how this could be used on people instead of by people.

Joy

• Art projects
  • Like mine and Spencer Chang’s.
• iOS contact swapping
• Home Automation
• Lego’s new Smart Play bricks
  • I feel like these are distinct from Amiibos, cuz you actually play with the NFC bricks instead of using them to unlock features in your video game.

As you can see, the “Joy” section is looking pretty thin. If you can think of anything else that fits, let me know!

Now, you might be thinking that some of the “Control” entries are kinda samey, just the same idea applied to different domains (hotels vs transit stations). You’re right, but I think listing them explicitly shows just how common these controlling systems are. Odds are you used one or more of them today.

Who controls the NFC Spec?

The NFC Forum is the organization that controls the hardware and software specs for NFC tag. While they say they are a “community-led organization of hundreds of organizations”, if you go to their Leadership page, you’ll see that their board is comprised of representatives from nine companies: Google, Apple, Huawei, Sony, and a host of semiconductor companies.

Their Member Companies page shows that their Principal and Associate members – the next steps down from the Sponsors who get the board seats – include all the big international payment rail companies: Mastercard, Visa, JCB, Discover, and more.

These are the companies that control the direction and vision of NFC technology and given how NFC tags are being used, I’m sure you can imagine what their vision is:

Every day millions and millions of people use NFC technology to connect to things and the world around them. It’s the super-fast and secure way to pay for things, ride the train, unlock a door, start your car, and even connect to the brands we all love.

The graphic on their homepage shows all the super-fast and secure things one can do with NFC tags:

This is the video they show to communicate how people might use the technology to “connect to the world around them” and over half of the examples are using NFC tags to protect private property. That is, to control people’s access to places or things.

Now, don’t get me wrong, I want my apartment door and hotel room to have locks just as much as the guy. But we’ve had locks and keys for millenia, no NFC tags required.

Beyond a small amount of convenience (it is a pain to carry around a massive keychain), NFC tag key don’t actually give much benefit to us normal people who just want to be able to lock their apartment door.

No, the actual benefit of NFC tags, the reason that companies like Google and Mastercard are interested in them, is the amount of surveillance and fine-grained control they afford the people who control the locks.

NFC Surveillance

During Hong Kong’s 2019/2020 protests, Hong Kongers refused to use their NFC Octopus cards to access the metro, out of fear of being tracked and flagged as having attended the protests.

They were right to be cautious:

“as police officers put it to the South China Morning Post, the card is like a GPS system because it can locate where and when the holder uses it.”
- Why Hong Kong’s protesters were afraid to use their metro cards

NFC tags enable centralized authorities to corral and surveil unfathomably large numbers of people, over time, with virtually no effort after the system is initially implemented.

This works at many different scales. Your office management or HR department can use it to track workers, landlords can use it to track tenants, city police can use it to track people around the city, and it’s part of the international payments/data broker system that can track people’s movements and purchases across the globe.

This kind of surveillance was possible at small scales before NFC tags, for example by having a receptionist record people as they enter/leave a building, or by trying to track people through CCTV recordings, but NFC tags make it much more feasible at the larger scales.

In recent years we’ve seen the rise of Flock cameras and the like¹, which can also track people’s movements through cities and stores. NFC tags have them beat on cost and PR though. They cost pennies, and while most people are a bit leery of the idea of cameras tracking them everywhere, fewer are concerned about their metro card.

Additionally, NFC systems allow the powerful to alter people’s access immediately. They don’t need to physically change any locks, they just make an update to a database, and suddenly a worker’s badge no longer grants entry to the building, or a tenant has been evicted from their apartment.

In part two, I’ll do a deep dive in to how Google uses their badge system as a way to create and maintain social hierarchies, but for now, I hope the point has been made that, for the NFC Forum and the companies that support it, the main function of this technology is control.

We are told that technology is a politically neutral force, that tools can be used for both good and evil. This is a lie².

Swords are made for killing, not for cutting vegetables.
Rocket fuel is made for missiles, not for spaceflight.
AI exists to turn us all into serfs, not so we can work less.
And, sadly, NFC Tags are made for control, not for joy.

If you the reader are in any sort of position of authority where you’re considering adopting an NFC based system, I urge you to not. Even if you have good intentions in mind, the system you build will too easily be turned to bad ends.

For the rest of us, I don’t think we’re getting rid of NFC tags anytime soon. Try to avoid them where you can, use cash where you can. Support legislation like NY Senate Bill S4886A which aims to make NFC transit data collection illegal. Learn how to clone NFC tags (you can do it with your phone), and maybe consider getting a Flipper Zero.

As for joy, if the bad guys are going to flood our world with evil technology, I’m at least going to try to subvert it. I’m going to keep making my NFC Sculptures and keep on teaching others to do the same. If nothing else, it helps keep me sane!

Stay tuned for part two of this series, I’ll hopefully finish it in a week or two, and stay safe out there everybody.