Home > Security > Privacy

Computerworld - The privacy scare surrounding radio frequency identification (RFID) tags is greatly overblown. No company or government agency will be secretly scanning your house, as is feared, to find out what products you've purchased. There is no feasible way to do so. But if RFID chip makers don't soon allay these fears, the escalating public emotion around this issue may effectively ban the most valuable implementations of this remarkable technology.
What are these mysterious devices? An RFID tag is a microchip the size of a grain of sand that transmits information to a nearby scanner. Typical chips store 96 bits of data and transmit a 125-KHz RF signal. Experts say that capacity is enough to send a product serial number to a scanner a few feet away. Although this capacity is limited, many companies see a revolution in the making.
Hospitals imagine a day when RFID tags will prevent medical errors by transmitting the correct medicine dosages to nurses. Automakers hope similar tags will be able to transmit wear-and-tear information on vehicles before serious problems occur. Postal services see speedier parcel scanning and tracking. Appliance makers and food producers envision faster and more targeted recalls of defective products. Clothing and shoe stores expect faster customer service as RFID tags help identify items of the right size. Clothes manufacturers hope the tags will be able to tell washing machines how to best wash items. The music industry sees the technology reducing piracy, and the federal government hopes RFID tags will help combat counterfeiting and speed bag-checking at airports.
Sound too good to be true?
Wal-Mart Stores Inc. and the Pentagon don't think so. They're counting on savings of several billion dollars that RFID tagging will bring them in the form of lower inventory-management costs. Items will no longer need to be individually hand-scanned, expediting product loading, invoicing and customer checkout. Scanners might be placed on shelves to speed restocking and at building exits to prevent theft. These lucrative benefits prompted both organizations to announce recently that their suppliers must tag their cases and pallets with RFID chips by January 2005 in order to continue doing business with them.

	Cline manages data privacy at Carlson Companies Inc., a Minneapolis-based group of businesses in the travel, hospitality and marketing industries. Contact him at privacy@computerworld.com. See more Jay Cline columns.

The story gets better. Analysts see these dual mandates causing a domino effect throughout the world economy. Procter & Gamble Co. -- which sells 17% of its goods through Wal-Mart -- expects pallet-level tagging to improve the speed by which it replaces out-of-stock products. P&G sees the technology boosting total revenue by $1.2 billion per year, nearly a 3% increase. Accenture Ltd. estimates that RFID adoption will cause retailers to enjoy an average 3% climb in revenue. Japanese analysts project a worldwide benefit of $276 billion by 2010.
So what's the problem?
Privacy advocates are concerned about tags on products continuing to emit signals in the parking lot, on the road and at home. They're worried that by using charge cards or loyalty cards during checkout, customer identities could be written to the tags. In the worst scenario, they imagine stalkers and thieves scanning cars and homes for expensive goods and personal information.
Some companies are already experiencing a customer backlash with their product-level tagging trials. Customers of a New York clothing store recently reacted against the prospect of their clothing sizes being beamed into the air. Wal-Mart reportedly had to cancel a pilot where it tagged packages of high-end razor blades because of strongly negative consumer feedback.
Stories of person-level tagging have only heightened fears of a Big Brother world coming to fruition. In Mexico, some children have reportedly been implanted with RFID chips under the skin so they can be tracked if they're kidnapped. A company in Brazil has supposedly implanted chips into the skin of its employees as their means to gain building access. Closer to home, a school in Buffalo is requiring students to wear RFID-tagged badges around their necks to track arrival times, and a prison is using RFID wristbands to monitor inmates. Some have speculated on the benefit of implanting in people RFID chips containing their medical and criminal histories. With friends like these, does Wal-Mart need any enemies?
The hype around RFID systems has certainly outpaced reality. Manufacturers and retailers have yet to agree on a universal electronic product code, the RFID equivalent of the Universal Product Code used in bar codes. RFID scanning is also far from error-free. But more importantly, RFID signals are so weak that they're easily blocked by metals and dense liquids. It's completely infeasible today for a vehicle to pass down your street and intercept signals from RFID-tagged goods inside your home.
The economics of RFID chips are also limiting how they're used. The most basic read-only chips cost 5 to 50 cents apiece. More complex chips that are read-write and have a wider broadcast range can cost several dollars each. Until these prices approach a penny, RFID chips will be mostly used at the case and pallet level, clear of any personally identifiable activity. Because of these technology and cost limitations, the world will have several years to identify the privacy controls we want to see in RFID systems.
Several companies are already creating these privacy controls. In recent meetings, chip makers and users discussed how the universally accepted principles of data privacy could be built into the RFID process. A top priority was notifying customers that certain items were tagged with these transmitters. The companies discussed accomplishing this by adopting a common RFID logo to place on product packages. To give customers the ability to turn off the transmitters, the firms plan to make them peel-offs. RSA Security Inc. is also developing a chip that could be worn on watches or bags that would block nearby RFIDs from transmitting certain information. All in all, the RFID privacy ball is rolling.
The gathering storm against RFID tags may soon outpace these positive efforts and make product-level RFID tagging taboo. RFID makers and users should take a time-out from their technical discussions and start talking more with the public about what's going on. Their dreams of big economic returns may well depend on it.
See more columns by Jay Cline.