Privacy concerns

RFID technology's cost and other benefits to suppliers—and, therefore, the price and other benefits to consumers—are apparent throughout the manufacturing, distribution, and sales processes, right up to when a cashier rings up the RFID-tagged item at the register. Beyond that point, if the RFID remains active, the benefits to consumers become more ambiguous, and the potential downsides, particularly as they relate to privacy, become more ominous.

The Wikipedia Web site, within its definition of RFID (www.wikipedia.org/wiki/RFID), includes a comprehensive summary of RFID's privacy issues, which the following list summarizes:

• The purchaser of an item will not necessarily be aware of or able to remove the tag;

• An RFID reader can read the tag at a distance without the knowledge of the individual;

• If a purchaser pays for a tagged item with a credit card or loyalty card, then the store could tie the unique ID of that item to the identity of the purchaser; and

• Tags create or may later create globally unique serial numbers for all products, even though this fact creates privacy problems and is unnecessary for most applications.

Standards-based RFID specifications include the ability to send a "kill" command to the tag. However, with current RFID-tag and -system designs, consumers have no guarantee and no indication of whether the system has sent the command. And consumers might not even view a permanently killed tag as a desirable outcome. In a UPC (universal product code)-free world, the EPC (electronic product code) might be a key part of the rebate process, for example, and it could find use when someone returns an item for refund. In this case, the store would have to replace the killed tag before returning the item to the sales floor.

A retailer can now use UPC and other information, along with your credit-card number, to precisely connect you to items you've purchased at the retailer's store. However, a global RFID database could potentially enable that retailer to extend that insight to items you've acquired elsewhere. That reach could extend to other activities: What could an RFID tag embedded in your passport, driver's license, license plate, or on your body reveal? Government agencies would, of course, have similar visibility with similar potential for both positive use and abuse. And how would you feel if a stranger, with a precision, high-gain antenna and sufficient DSP horsepower, could park outside your home and scan and analyze its RFID-tagged contents?

Some pundits believe that RFID critics exaggerate privacy fears because the high costs of RFIDs restricts their use to multi-item, not individual, cases. This stance seems naive in the face of years' worth of Moore's Law-driven cost-reduction trends. Also keep in mind that, for large items, such as computers and televisions, there is only one case. Other pundits claim that RFID is just the latest in a long line of technologies whose unveiling instigated a chorus of concern, but whose benefits eventually outweighed the downsides. RFID may be different, though. Once manufacturers implement it, we cannot turn back, and, even with legislative oversight, the checks and balances in the system to prevent abuse seem, at best, tenuous.

Some analysts point out that consumers have thus far been apathetic and careless about their privacy and are happy to sell their identities for free gifts, store discounts, and the like. Although these observations may hold some truth, one important distinction exists. In the past, consumers have consciously chosen to give up their privacy. They do so whenever they swipe their supermarket discount card, fill out and send a Web-site form, or mail in a rebate or registration card. With RFID, consumers cannot make that choice; monitoring occurs regardless of whether they have approved it.

At this year's Blackhat Conference in Las Vegas, Lukas Grunwald, a senior consultant with DN-Systems Enterprise Solutions GmbH, unveiled the RFDump program , which showed just how easily anyone with a reader can access and alter RFID-tag contents. Tag cracking should be of concern to both consumers and retailers: Why bother shoplifting when you can, armed with a handheld computer, an RFID-reader add-in card, and a copy of RFDump, reduce the price of that new jacket from $100 to $25? And the potential exists for illicitly scanning a home from the sidewalk, despite RFID's claimed inches-to-feet frequency-dependent maximum range. Remember that 802.11 signals that once extended only a few yards now can span multiple-mile distances, thanks to increasingly sophisticated signal-processing and error-correction algorithms, along with low-tech Pringles cans, which concentrate the signal's energy in a focused direction.

For more information on the privacy issues surrounding RFID and on advocacy efforts to increase consumer awareness and influence private and public policy concerning RFID, visit the following Web sites: the ACLU (American Civil Liberties Union, www.aclu.org), CASPIAN (Consumers Against Supermarket Privacy Invasion and Numbering, www.nocards.org), and the EFF (Electronic Frontier Foundation, www.eff.org).

Application teasers

The following list includes some of the more interesting applications for RFID. They might inspire you to use RFID technology in your future designs and increase your awareness of the privacy issues associated with RFID.

• Wal-Mart’s challenge to its suppliers, which it first issued at the June 2003 Retail Systems Conference in Chicago, was the key spark that ignited significant industry momentum behind RFID. Pilot implementations with key suppliers are under way at Wal-Mart’s Sanger, TX, distribution center and seven Dallas/Fort Worth-area stores. Wal-Mart’s top 100 suppliers have until next January to install tags on items headed for three Texas distribution centers. By June 2005, Wal-Mart expects to have its RFID project live in as many as six distribution centers and as many as 250 Wal-Mart and Sam’s Club locations. By January 2006, the next 200 suppliers are scheduled to join the initiative. Wal-Mart’s competitors, such as Albertsons, Best Buy, Kroger, Target, and Europe’s Metro Group, have responded by launching their own RFID trials.
  

• The US government, motivated by homeland security, inventory tracking, and other concerns, is another significant catalyst for RFID action. Department of Defense suppliers must by next January begin using RFID on portions of their inventory. The Department of Transportation’s Federal Highway Administration has also called on RFID manufacturers to jointly develop DSRC (dedicated short-range-communications) systems as part of the agency’s efforts to halve road fatalities in the United States within 10 years. Potential roadway applications include issuing alerts to drivers about impending intersection collisions, rollovers, and weather-related road hazards and warning drivers that their vehicles are traveling too fast to safely negotiate an upcoming curve. The Federal Communications Commission in 1999 allocated the entire 5.9-GHz band to DSRC applications. The State Department is conducting a trial of RFID-inclusive biometric passports, with an eye toward moving to full production in 2005. (The International Civil Aviation Organization has unveiled a similar proposal, with a 2015 deadline.) And the Customs Service’s CSI (Container Security Initiative) and SST (Smart and Secure Trade) Lanes Initiative are embracing RFID technology as a way to help ensure container security at US ports. To date, the governments of the top 20 foreign ports, representing approximately two-thirds of the volume of shipments to the United States, have agreed to implement CSI and SST.
  

• Governments outside the United States are also evaluating and implementing RFID. Persistent rumors suggest that the European Union is planning to embed RFID tags in high-value euro notes. (Rumors of RFID tags embedded within US $20 bills, conversely, are unfounded.) The United Kingdom is also studying license plates with embedded RFID tags, which readers can decipher from 300 feet away and  readers embedded in the road or  surveillance vehicles can decipher  in rapid succession. And electronic ear-tagging of sheep and goats, fueled by recent “Mad Cow”-Disease outbreaks, will be compulsory in Europe beginning in January 2008 for member states with livestock populations of 600,000 or more.  ISO 11784/85 also stipulates that it will also be compulsory for animals intended for inter-European Union trade; domestic-
  RFID-supplier Philips has been particularly active in this area. Canada will also implement electronic tagging of livestock next January.
  

• Significant RFID implementation potential exists in the pharmaceutical industry to track drugs (likely extending to individual packages, not just bulk cases) and prevent counterfeiting, unintended redirection, and theft.
  

• E-Zpass and FasTrak systems implement electronic-highway-toll collection. Those concerned about privacy should note that they can log not only your preferred payment method, but also the dates, times, and locations your car’s RFID tag passed readers. Other RFID-based electronic-payment systems include ExxonMobil Speedpass, MasterCard’s PayPass, NCR’s FastLane system, and FreedomPay. Nokia has unveiled its first RFID-inclusive cell phone add-in kit for electronic item payment, the Mobile RFID Kit for the model 5140. And Nokia, Philips, and Sony have formed the RFID-derived Magic Touch alliance for mobile commerce and information exchange.

• Many of you are likely familiar with the “chipping” programs from such companies as Avid and HomeAgain for identifying pets and returning them to their owners. This scenario is extending to humans. The Mexican government recently used technology from VeriChip to subdermally tag Mexico’s Attorney General Rafael Macedo de la Concha, along with 160 of his employees working at an anticrime information center in Mexico City. Other places in Central and South America, including Argentina, Brazil, and Columbia, are employing the technology in response to escalating incidents of “flash kidnapping,” involving short amounts of time in captivity. And at the Baja Beach Club in Barcelona, barely clothed patrons who don’t want to bother with carrying currency are sporting subdermal tags to enable electronic “credit-card” payment of their food and drinks.

• Japanese primary schools in Osaka and Tabe are tagging students’ clothing, bags, and name-
  tags, so that teachers and parents can track the children’s whereabouts. For similar reasons, the Wannadoo City theme park in Florida is tagging all ticket holders upon entry, so that members of each group can find each other in real time. Premium Club Seat ticket holders at the Seattle Seahawks’ Qwest Stadium can use RFID-inclusive PowerBuy tags that reduce their time in line at concession stands. Texas Instruments is both an RFID supplier and an RFID consumer, and it employs RFIDs for tracking work in progress within its fabs. And 2004 Olympic Marathon and Boston Marathon participants’ shoes contained RFID tags, which communicated at regular intervals with readers embedded in the pavement or within mats on the raceway. These tags not only prevent Rosie Ruiz-reminiscent fraud, they conceptually also could allow runners’ friends, families, and fans to follow race progress through periodic Web-site updates, pager alerts, and the like.

• Texas Instruments has also worked with the Vatican Library in Rome to RFID-tag, identify, and manage its extensive collection of nearly 2 million books, manuscripts, and other priceless items. And the San Francisco Public Library, in the face of stiff opposition from the EFF (Electronic Frontier Foundation) and other privacy groups, is considering RFID-tagging its collection.

• Delta Airlines is running a luggage-tracking pilot between Jacksonville, FL, and Atlanta and plans a widespread roll-out for 2007. The Jacksonville airport is planning a year-end rollout of RFID tagging in advance of next February’s Super Bowl, and Las Vegas’ airport is also planning a spring 2005 RFID implementation. In contrast, San Francisco’s and Seattle’s airports have, for now, shelved their RFID pilots, citing high costs and tag-reading reliability that wasn’t appreciably better than that of the bar codes currently in use.

• Airframe competitors Boeing and Airbus are partnering to require their more than 2000 suppliers to begin tagging aircraft and engine parts by mid-2005. The goal is multifold: to tackle incorrect pricing and part-number data and to prevent unapproved parts from finding their way into finished products with consequent excessive costs in the form of Federal Aviation Administration fines and replacement downtime. Boeing is currently conducting RFID-tagged engine parts trials with Federal Express and Delta Airlines. The three companies’ are currently using worldwide-standard, 13.56-MHz tags, which deliver robust operation in high-temperature and reflection-inducing, metal-rich environments. They also plan to test higher storage capacity, 915-MHz tags, but Europe has not yet approved them.

• Microsoft has announced plans to include RFID support within future iterations of its Axapta, Great Plains, and Navision ERP (enterprise-resource-planning) applications and to add device-driver-like RFID support to its future server operating systems. Microsoft in April launched an RFID Council.

• Oil ID Systems plans to use RFID “motes,” each about the size of a grain of sand, to track oil as the company stores, ships, and sells it. Along similar lines, Japanese company Kureha Kankyo, an affiliate of Kureha Chemical Industry, in partnership with IBM Japan, is testing the ability to track medical waste by embedding RFID tags and antennas within cardboard and plastic containers.

• Other “out-there” conceptual applications include RFID-inclusive clothing that automatically configures the washing machine and dryer, food that alerts the refrigerator—and you—when it has expired and automatically adds itself to an electronic grocery list, and medications that track your consumption and alert you and, perhaps, also your physician and pharmacist to deviance from its prescribed usage, as well as warning of contraindications with other drugs currently in your medicine cabinet.

Additional insights

News and discussion sites, such as Slashdot (www.slashdot.org) and The Register (www.theregister.co.uk), regularly follow RFID topics, especially as they relate to privacy concerns. IT publications that regularly cover RFID topics include eWeek (www.eweek.com/category2/0,1738,1568291,00.asp), Information Week (www.informationweek.com/techcenters/hw/rfid/), and InfoWorld (www.infoworld.com/techindex/radio_frequency_identification_-_rfid.html. Other useful RFID portals include the Association for Automatic Identification and Mobility (www.rfid.org), the RFID Journal (www.rfidjournal.com), which contains a comprehensive glossary of terms and set of frequently asked questions, the RFID Web log (www.rfid-weblog.com), and RFDump.org, where you can download a copy of Lukas Grunwald’s RFDump, which shows how easily anyone with an RFID reader can access and alter RFID-tag contents.

&/& span>