Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
In the UK, what does the law say regarding the legality of cloning RFID tags that you own, but did not generate?
I'm particularly interested in cases like the Mifare Classic tags, where you may need to perform an exploit to find encryption keys in order to clone the tag.
The problem is going to be the "need to perform an exploit to find encryption keys."
I'm sure you agreed to a software/hardware license with the purchase of the tags, and the license and/or TOS probably forbids reverse engineering or the use of an exploit to be able to do anything with the tags other than use them in the manner that Mifare clearly dictates, i.e. use the products in the way Mifare wants you to use them as outlined in the license.
So read the license from Mifare and see what it says; it is a contract between you and the company. If you break the contract, Mifare could take action against you. What that action is could be simply closing your account, refunding your money, not selling you any more tags, or a civil lawsuit for violating the license by cloning the tags.
If you only clone tags for yourself and don't advertise it or distribute them, Mifare probably won't find out, but it's still a violation of the license and the breaking of the contract.
As for possible criminal charges (if Mifare was able to convince a crown prosecutor to take action) there are the laws outlined at Cybercrime - Prosecution Guidance | The Crown Prosecution Service, but it may be a stretch, since you're talking about simple RFID tags. But the Forgery and Counterfeiting Act could be applicable.
