|
Article Excerpt
Abstract. Radio Frequency Identification, or RFID, is a technology which has been receiving considerable attention as of late. It is a fairly simple technology involving radio wave communication between a microchip and an electronic reader, in which an identification number stored on the chip is transmitted and processed; it can frequently be found in inventory tracking and access control systems. In this paper, we examine the current uses of RFID, as well as identifying potential future uses of the technology, including item-level tagging, human implants and RFID-chipped passports, while discussing the impacts that each of these uses could potentially have on personal privacy. Possible guidelines for RFID's use, including Fair Information Principles and the RFID Bill of Rights are then presented, as well as technological solutions to personal privacy problems, such as tag killing and blocker tags, as well as simple aluminum foil shields for passports. It is then claimed, though, that guidelines and technological solutions will be ineffective for privacy protection, and that legislation will be necessary to guard against the threats posed by the RFID. Finally, we present what we believe to be the most important legislative points that must be addressed.
Key words: item-level tagging, passports, privacy, tags, tracking, Radio Frequency Identification, RFID
Introduction
Radio Frequency Identification, or RFID, is a technology based on the need for remote recognition of objects. RFID tags communicate identification numbers to electronic readers via radio wave, allowing both the presence and identity of a tagged object to be determined without requiring line of sight or physical contact; thus, its main uses have always included inventory tracking, electronic toll collection on highways, and access control. This technology finds its origins in a problem encountered during the Second World War. The United Kingdom found that while radar could recognize the presence of incoming aircraft, it could not determine the planes' nationalities. In order to make this determination, 'identification friend or foe' (IFF) radio transponders were added to Allied planes, which allowed them to show up with distinctive 'blips' on the radar screen ("RFID" 2005). In this way, RFID was born. In 1948, however, it was stated in the first academic paper on RFID that "... considerable research and development work has to be done before the remaining problems in reflected-power communication are solved, and before the field of useful applications is explored." ("RFID" 2005) In the present day, that research is well underway. RFID's usage is currently undergoing a revolution, being incorporated into everything from automobile keys to product packaging to passports. With this deployment, though, have come great concerns about the technology's effect on the privacy. This paper will explore the recent history of RFID and examine the privacy issues arising from its use, as well as addressing potential means of handling those issues. Finally, the authors' views on the most effective solutions to the privacy problems created by RFID will be presented.
The present state of RFID
Technology
The technology behind current RFID is rather uncomplicated. In its simplest form, it consists of a tag (microchip) and a reader. The tag consists of an electronic circuit which stores data and an antenna which broadcasts this data by radio wave in response to a query signal from a nearby reader. The reader also contains an antenna which receives the radio signal, and also has a demodulator which transforms the analog radio data into digital data suitable for any computer processing which will then be done. 'Active' RFID tags include a battery, allowing them to constantly transmit the data stored on the circuit, whereas 'passive' tags contain no energy source, instead receiving their power from the reader's initial query. Passive tags are thus less expensive, smaller, and have a longer lifespan (no battery means that the integrity of the hardware alone determines functionality) than their active counterparts, and are the standard form of tag being adopted for commercial use. These tags can be read at distances of up to 10 m, though for high security applications this range can be limited to as low as 10 cm. Active tags have a larger broadcast range (up to 100 m), and are generally used when the location of the tag is more important than the data stored on it; for instance, a slight variation on these tags is used in bracelets given to young visitors to Denmark's Legoland amusement park, so that lost children can quickly be located.
A standard RFID tag stores a simple identification number, usually either 96 or 128 bits long, and contains few or no security measures to protect that data. However, by incorporating a more advanced microchip onto the tag, variations on RFID technology such as 'smart cards' are created, which can contain from 512 bits to 72 Kb of memory, various data protection and encryption schemes, and a limited read range. This form of contact-less information transfer is used when privacy is deemed to be vital, such as in electronic payment or identification cards.
Current uses of RFID
Though it has not emerged as a privacy issue until recently, the use of RFID technology has been widespread for some time. Tens of millions of pets worldwide have been 'chipped' in order to facilitate their identification at animal shelters. It is estimated that in the United States alone, 6000 animals were reunited with their owners due to their RFID tags every month in 2003 (Hines 2004). Animal tagging is also being done in an attempt to prevent the spread of disease; at least 20 million livestock have been tagged in order to track outbreaks of Mad Cow and other diseases, and Portuguese legislators have ordered that the nearly two million dogs in that country be chipped and registered in a national database in an effort to control the spread of rabies. It is certainly not just animals which are being tagged, however. According to Texas Instruments vice-president David Slinger, the revolution in RFID usage began in 1993 with an effort to deter auto theft. A chip was added to the ignition key of vehicles, and a transponder was incorporated into the steering column; if the wrong key (or no key) were used to start the car, it would be immobilized. Seven of ten cars now have this feature, and Ford is reporting that theft rates on their oft-targeted Mustang line are down 75%.
Nearly 40 million Americans already carry RFID tags (Garfinkel 2004), whether they are embedded in car keys, building access devices, or speed payment fobs. However, the RFID industry did not reach its current level of prominence until an order was given by the largest, most powerful retailer in the world, WalMart.
The WalMart mandate
In June 2003, Arkansas-based retailer WalMart made an announcement which changed the world of RFID. It was a mandate that by January 1st, 2005, each of the store's top 100 suppliers would have to add an RFID tag to all shipping crates and pallets sent to any WalMart distribution centre. In addition, the next 200 largest suppliers would have to comply with this mandate by the same date in 2006. Demand for RFID tags skyrocketed, as it was estimated that the top 100 suppliers alone will require at least 1 billion tags per year to comply with this order (Williams 2004). In fact, by mid-2004, it seemed as if this mandate was too demanding to be accomplished; not for the suppliers, but for the RFID manufacturers. Demand was so high that many wondered whether it was possible to produce enough tags to meet it. However, each of the top hundred have agreed to tag at least a portion of their shipments; in all, by the end of January 2005, 65% of pallets and cases shipped to WalMart contained an RFID tag (Bednarz 2004).
The WalMart mandate will likely provide two benefits to the RFID industry in addition to instantly creating a huge market. First, a standard for RFID technology can be created; rather than develop many different, incompatible tags and readers, it is more sensible for companies to use the retailer's preferred style of...
|
