by Simson L. Garfinkel
Feb 4, 2004
Simson L. Garfinkel was chair of the RFID Privacy Workshop, held at the Massachusetts Institute of Technology last November 15. More information on RFID and related privacy issues can be found at www.rfidprivacy.org.
n November 15, fifteen privacy and consumer organizations called for manufacturers to voluntarily hold off on their plans to equip consumer goods with wireless tracking devices. These devices, called Radio Frequency Identification tags, are based on the same technology that lets cars pay E-ZPASS tolls without stopping. The fear of these activists is simple: They're worried that instead of being used to track boots, bluejeans and books, these so-called RFID systems will be used to track us.
RFID isn't a household word today, but within the next few years manufacturers hope to put it into many household products. Last January Gillette ordered 500 million RFID chips from a California manufacturing firm called Alien Technology; Gillette plans to put the tags into packages of its razors and blades so that the high-value consumer goods can be tracked as they move from the factory through distribution and eventually to the store shelf. Last March Benetton announced similar plans to weave RFID tags into its designer clothes; the company reversed itself after a grassroots consumer group launched a worldwide boycott of Benetton products.
As its name implies, RFID systems are based on radio waves. Each tag is equipped with a tiny radio transmitter: When it "hears" a special radio signal from a reader, the tag responds by sending its own unique serial number through the air.
This wireless technology could save American businesses billions of dollars. With RFID readers at the loading docks and on the store shelves, retailers could know precisely how many packages of, say, lipstick had been received and how many had been put on the shelves. And once every product in the store is equipped with an RFID tag, stores might even be able to have an automated checkout: Shoppers could just push their carts through a doorway and have all the items in the cart automatically totaled and charged to the RFID-enabled credit card in their pocket.
Both Wal-Mart and the US military have already told their hundred largest suppliers that cartons and pallets must be equipped with unique RFID tags by January 2005. Meanwhile, MasterCard and American Express have been testing RFID-enabled credit cards. Mobil has been pushing its RFID-based "Speedpass" since 1997. And most high-end cars now come with RFID "immobilizer" circuits that won't let the cars start unless the correct RFID-enabled car key is in the ignition.
So why did the American Civil Liberties Union, the Electronic Frontier Foundation, The World Privacy Forum and a dozen other organizations ask for a voluntary moratorium on RFID technology in consumer goods? Because this use of RFID could enable an omnipresent police surveillance state, it could erode further what's left of consumer privacy and it could make identity theft even easier than it has already become.
RFID is such a potentially dangerous technology because RFID chips can be embedded into products and clothing and covertly read without our knowledge. A small tag embedded into the heel of a shoe or the inseam of a leather jacket for inventory control could be activated every time the customer entered or left the store where the item was bought; that tag could also be read by any other business or government agency that has installed a compatible reader. Unlike today's antitheft tags, every RFID chip has a unique serial number. This means that stores could track each customer's comings and goings. Those readers could also register the RFID tags that we're already carrying in our car keys and the "prox cards" that some office buildings use instead of keys.
The problem here is that RFID tags can be read through your wallet, handbag, or clothing. It's not hard to build a system that automatically reads the proximity cards, the keychain RFID "immobilizer" chips, or other RFID-enabled devices of every person who enters a store. A store could build a list of every window shopper or person who walks through the front door by reading these tags and then looking up their owners' identities in a centralized database. No such database exists today, but one could easily be built.
Indeed, such warnings might once have been dismissed as mere fear-mongering. But in today's post-9/11 world, in which the US government has already announced its plans to fingerprint and photograph foreign visitors to our country, RFID sounds like a technology that could easily be seized upon by the Homeland Security Department in the so-called "war on terrorism." But such a system wouldn't just track suspected Al Qaeda terrorists: it would necessarily track everybody--at least potentially.
Despite these fears, the privacy activists aren't saying that RFID technology should be abandoned. As it is, the technology is already in broad use currently for the tracking of pharmaceuticals (and the elimination of dangerous drug counterfeits), for tracking shipments of meat (so that contaminated batches can be rapidly identified and destroyed) and even for tracking manufactured goods to deter theft and assist in inventory control.
But companies that are pushing RFID tags into our lives should adopt rules of conduct: There should be an absolute ban on hidden tags and covert readers. Tags should be "killed" when products are sold to consumers. And this technology should never be used to secretly unmask the identity of people who wish to remain anonymous.
I was proud to be one of the people endorsing the position statement on the use of RFID in consumer products. If companies do not voluntarily abide by these principles, we should push to have them incorporated into the laws that protect our privacy rights at the state and federal level.
Wal-Mart Stores and its largest 100 merchandise suppliers plan to meet this week to plot the implementation of a new high-tech inventory-tracking system, a project expected to send ripples across the retail industry.
The meeting, scheduled for Tuesday near Wal-Mart's Bentonville, Ark., headquarters, follows the megaretailer's announcement in June about its foray into a technology known as RFID (radio frequency identification). At the time, Wal-Mart asked its top 100 suppliers to join the effort and, starting Jan. 1, 2005, attach RFID tracking "tags" to the millions of cases and containers they ship to the company.
Among the companies congregating in Bentonville for a full briefing from Wal-Mart are industry giants Kraft Foods, Procter & Gamble, Tyson Foods and Unilever, a Wal-Mart representative said. Some big names in information technology will also be in town, with IBM, Intel, Microsoft, Philips Semiconductor and SAP participating in an RFID "tech expo" Wednesday.
RFID tags, which contain special microchips and antennae, are designed to automatically relay to computers precise information about the contents of product packages and containers. The technology is expected to reduce much of the manual labor and human error involved in tracking inventory via bar codes and could save Wal-Mart close to $8.4 million annually, according to investment research firm Sanford C. Bernstein.
But less clear are the benefits for Wal-Mart's suppliers, many of whom already have highly accurate inventory systems, according to a recent report from IT analyst firm AMR Research. It's a critical question, given that large suppliers will spend an average of $13 million to $23 million to comply with Wal-Mart's plan, AMR Research estimates.
"Other than maintaining positive relationships with Wal-Mart, almost no company attending the symposium could readily identify immediate value in implementing the technology," the report states.
A spokesman for the retailer dismissed the notion, insisting that the technology will be a boon to suppliers as well as to Wal-Mart. "Analysts always have to come up with something," Wal-Mart spokesman Tom Williams said.
The benefit to manufacturers comes only when RFID is deployed in stores to decrease stock-out situations, AMR analyst Kara Romanow said. But because of costs and privacy concerns, that could be 10 years away or more, experts said.
Procter & Gamble, which has been deeply involved in the testing and development of retail RFID systems for the last several years, is optimistic that RFID will be more than just another cost of doing business with the world's largest retailer.
"We see that this technology has huge benefits, even at the case and pallet level, in helping us to track our product and helping us understand how long does it take to get through the supply chain," a P&G representative said.
RFID transfers data wirelessly between a minuscule transceiver and a transponder, or "tag," that can be attached to just about anything -- an item in a store, a shipping container, even livestock.
..."On June 6, I walked around and wiggled the smart shelf [in a Brockton, Mass., Wal-Mart, where the test was about to launch]. The next day, it was gone," proudly reports Katherine Albrecht, executive director of one of those groups - Consumers Against Supermarket Privacy Invasion and Numbering (CASPIAN).
A month later, CASPIAN called for a boycott of Gillette, darkly dubbing the RFID transceivers embedded in razor-blade packaging "Gillette spy chips." A Gillette spokesman dismisses the boycott, saying the company has no intention of tracking individual customers and their purchases.
Gillette also denies that the privacy groups had any influence on the decision to cancel the smart-shelf trial, as does Wal-Mart. They say the companies opted instead to focus their attention farther up the supply chain, at the palette and case levels.
Clearly, though, groups such as CASPIAN have had a sobering effect on these companies and other businesses working to improve supply-chain management through RFID. And few industry watchers doubt that privacy-group pressure will force companies to examine the consumer-privacy ramifications of the technology and establish a code of conduct. Public protest also may slow RFID adoption by cautious companies...
AMSTERDAM (Reuters) - Radio signals for the next generation of mobile phone services can cause headaches and nausea, according to a study conducted by three Dutch ministries.
The study, the first of its kind, compared the impact of radiation from base stations used for the current mobile telephone network with that of base stations for new third generation (3G) networks for fast data transfer, which will enable services such as video conferencing on a mobile device.
A base station, which usually covers a "cell" area of several square kilometers (miles), transmits signals to mobile phones with an electromagnetic field.
"If the test group was exposed to third generation base station signals there was a significant impact ... They felt tingling sensations, got headaches and felt nauseous," a spokeswoman for the Dutch Economics Ministry said.
In a move that may have brought unwanted attention to a burgeoning industry, Italian clothing maker Benetton Group said it has not embedded any radio frequency identification tags in any of its clothing.
The group was responding to recent press reports that the company planned to incorporate radio frequency identification tags -- wireless transmitters the size of a grain of sand -- into the labels of its clothes to track garments worldwide.
"Instead of providing answers, they backed out of the deal," one industry analyst said of the unexpected announcement. "It is a step back for the RFID industry."
Like a few other industry insiders, the analyst did not want to be named. Some were concerned that the media had spread misinformation about how RFID tags really work, pushing Benetton to hastily release its statement.
About two weeks ago, Dutch semiconductor maker Royal Philips Electronics said it would provide the chips to power Benetton's RFID system, igniting a barrage of media coverage speculating how the technology would be used. Benetton said the chips' sole purpose was to track its clothes, although privacy advocates feared it could be used to locate customers and market to them.
After one consumer group called for a boycott of Benetton clothing, the Italian company issued a statement on Friday retracting its plans and distancing itself from Philips...
Facing increasing resistance and concerns about privacy, the United States' largest food companies and retailers will try to win consumer approval for radio identification devices by portraying the technology as an essential tool for keeping the nation's food supply safe from terrorists.
The companies are banding together and through an industry association are lobbying to have the Department of Homeland Security designate radio frequency identification, or RFID, as an antiterrorism technology.
02:00 AM Sep. 15, 2003 PT
A consortium of retailers and consumer goods companies plan to unveil the replacement for the bar code next week. The upgrade will use a controversial radio technology that critics say will significantly expand the powers of retailers to track the whereabouts of their goods and the people who buy them...