RFID Tags and the Question of Personal Privacy
Nov 18, 2003 4:21 AM PT
Radio Frequency Identification, or RFID, is an old technology that has been quietly revolutionizing business and industry. Back in World War II, the British used RFID signals to confirm the identity of their own aircraft in flight. Today, RFID has permeated our society. It is used to track everything from pets to prisoners to products.
Over the past several years, the technology has helped optimize inventory and business systems and has made consumers' lives more convenient. But some industry watchers say RFID has the potential to become a threat to user identification security.
To address that security threat, one company -- called RSA Security -- has developed a device to block certain tagged information so RFID scanners cannot see it. Such "blocker tags" are designed to disrupt RFID transmissions and thus protect a person's privacy from those who might abuse it.
RFID's Many Uses
Perhaps the most common use of RFID tags today is retail security and inventory management. But there are countless other applications. An Italian washing-machine maker has designed a washer that can read care instructions sent by an RFID chip sewn into garments and then adjust the washing process accordingly.
Drivers now can glide their vehicles through tollbooths without stopping to pay. Their RFID-enabled EZ Pass transponders take care of payments automatically. Motorists also can use a "speed pass" to hurry through gasoline purchases at service stations that use the technology. The speed-pass device contains an RFID microchip.
Museums use RFID tags to guard their priceless artwork. And attendees at Oscar presentations are screened and tracked with RFID tags to enhance security.
Even refrigerators soon will be able to read the RFID tags of their contents. These smart ice boxes then will alert their owners to fetch another carton of milk, toss out an out-of-date product or cut back on unhealthy dietary items.
Microchip-based RFID tags started appearing in the consumer markets in the late 1980s. Their first uses were in access systems for office buildings and toll roads. Today they provide keyless access to automobiles as well as offices.
Some business analysts are predicting that RFID technology will get a big boost in adoption next year, particularly as RFID-related technology sales are approaching US$1 billion and could reach as much as $10 billion by the end of the decade.
RFID technology is rooted in reader devices that send out radio waves to scan an RFID chip. Traditional bar-code readers scan one item at a time; in contrast, an RFID reader can scan an entire grocery cart full of goods at one time. A series of RFID readers strategically placed can track supplies from factory through warehouse and even to store checkout counters.
The ability of RFID-tagged products to track merchandise from inception to the point of sale and beyond has some privacy experts sounding an alarm. These privacy advocates worry about the prevalence of RFID tags eventually being used to track people unwittingly.
Several watchdog organizations already have sprung up to oppose use of RFID tags to track human beings. One such organization is the Auto-ID Center, an academic research project headquartered at the Massachusetts Institute of Technology.
Ari Juels, principal research scientist at RSA Security, said his company has filed several patents on a blocker tag process that will protect the company's branding rights as marketable devices are developed.
"At this point, blocker tag technology is a research project," he said. "We don't know how rapidly consumer problems will arise, so we don't know when blocking tags will be on the consumer level. Consumer privacy problems are not likely to surface for the next few years."
Much Like Cookies
Juels said that using RFID microchips to track consumer activity could be much like the evolution of cookies placed on an Internet user's computer. Cookies offer convenience to repeat site visitors. They are not harmful to the computer and merely help identify the visitor to the Web server.
Like a cookie, RFID tags are not by themselves malevolent. They are designed to streamline supply lines, and they have relatively short tracking ranges. Concerns about privacy will become more of an issue when longer radio reception ranges are developed with smart products, said Juels.
When this happens, blocker tags will be able to block the ability of RFID readers to acquire certain consumer information that might be encoded in the RFID microchip, according to Juels. "Otherwise, blocker tags won't disrupt normal reader functions."
The technology to block RFID data will be easy for consumers to use. It will be passive, said Juels, and will be as easy as carrying a blocker device in a shopping bag or having one embedded in a key chain or in jewelry.
Privacy Concerns Need Attention
Dedric Carter, director of technology innovation at American Management Systems, doesn't see a need for alarm over invasion of privacy issues with RFID technology. He told TechNewsWorld that the industry already has established controls to prevent privacy concerns but must continue to develop more safety features.
"Any new technology has certain risks; more controls are needed with wireless information access because an open signal is inherently less secure," he said. "RFID will be one channel in a multichannel [information] network."
Think of RFID blocker tags as performing a function similar to a call-blocking service to caller ID telephone systems. According to Carter, the United States must play catch-up on RFID security technology. The RFID industries in Europe and Canada have stricter standards.
Carter doesn't see these issues being fully solved until at least 2006. By then, he said, RFID readers will have replaced 30 percent of traditional bar-code readers.
Avi Outmezguine, legal executive for intellectual property at Scanbuy, said the issues surrounding RFID information exchange haven't existed for traditional bar-code readers.
Scanbuy develops technology centered around bar coding rather than radio frequency. With Scanbuy's method, user information is stored in the reader and is transported via the Internet. "There are no privacy issues involved [with bar codes] because the information is sent by the willingness of the user," Outmezguine said.
"But the real privacy issues raised over RFID make a lot of sense," he added. "That process involves giving information to others that a lot of people are not usually willing to give." Outmezguine said it will be up to the government to step in and help consumers keep their personal details private.