Concerned About RFID Tags? You Should Be.
The competitiveness of today's business world is forcing companies to develop new and innovative methods to stay ahead. The faster and more efficiently a company delivers their product to the consumer, the better that company will fare. On that same token, the company that knows the most about what their customers really want has a serious advantage over their competitors. Just how far is a company allowed to go to acquire that information though?
All of us believe that we are entitled to a reasonable amount of privacy. If someone were to break into your house and start to record everything you bought recently and where it came from, you would probably feel more than a little violated. Regardless of why the person was doing it, you would feel uncomfortable if he or she knew that last week along with your normal purchases you bought three packs of Dr. Scholl's wart remover, or maybe that your designer jeans no longer fit and you had to buy the next size up. Perhaps that person finds out that you only use a credit card at certain stores and pay for everything else with cash. How would that make you feel?
Unfortunately, with the development of recent technologies, it's possible that a person can easily gather a world of information without you ever knowing. Radio Frequency Identification Tags, or RFID for short, are an up-and-coming technology that is used to identify and track products throughout the world. Many experts believe RFIDs will replace our traditional UPC bar code system in the near future. Unlike a UPC though, the RFID tags are very small, inexpensive microchips that uses radio waves to transmit their information to a reader. The problem with RFIDs however is that the information stored on them is incredibly insecure, yet few people know just what exactly they are and there has been very little debate on the appropriate uses for them. In this paper, I will give a brief overview about how an RFID tag works and what it is capable of. Then I must go over the reasons why society should be concerned by them and what should be done about them. RFIDs can have many legitimate purposes in business, but if they are not used with discretion, they pose a serious threat to consumers and privacy in general.
What is an RFID anyways?
As I mentioned before, few people have even heard of RFIDs yet, so I think it is necessary to go over briefly what they are and how they work. An RFID is a small microchip that looks very similar to the magnetic security devices that stores have been using for years now. They are used to store information about an associated product for inventory, shipping, and retail purposes. A single chip can hold data about a product’s price, location, dimensions, or anything else the user wants to save on them. Basic RFIDs only cost about 5 cents to make, therefore they can be mass-produced for a relatively low cost. They use either a 13.56 or 915 MHz radio signal to transmit data (in comparison, radio stations broadcast their signal only between 88 and 108 MHz). Along with the data it stores, all RFIDs broadcast a unique ID number. Since hundreds of tags are meant to be deployed in a relatively small area, this ID number allows each tag to distinguish itself from others when a reader is picking up the signal.
One common myth about RFIDs that should be expelled immediately is that they are just like a small radio station, always on and broadcasting constantly. Fortunately for privacy advocates, that is completely false. RFIDs must be within range of a reader in order to operate. The reader can be anything from a small handheld device that only reads certain tags, to large security gate that reads anything that passes through. Most readers also have the ability to write to the tag. Therefore if anything about the item were to change, such as it being shipped across the country, the tag can be updated very quickly.
RFIDs are called passive transmitters because they are able to capture enough energy from the transmissions between themselves and the reader to operate. Once the reader passes out of range, the tags go back to sleep until another one passes by. The 13.56 MHz models normally only work when they are within two feet of a reader, but the 915 MHz models used in both supply and retail applications can transmit a signal at a distance of up to 30 feet or more. The maximum distance is largely determined by the power and length of the reader's antenna, so these distances will more than likely increase as the technology improves and refines itself. Furthermore, many experts believe it is highly likely that illegal readers with larger antennas will emerge that can read tags at far greater distances than previously imagined. (Molnar, Wagner 211)
Finally, and most importantly, is how much information can be stored on an RFID. The amount of storage is really only limited to what the manufacturer can afford to incorporate onto a tag, but RFIDs generally only hold only 8 to 16 bytes of information. (Jules, Rivest, Szydlo 104) This is very small compared to the massive amount data a standard desktop computer can hold, but when matched up to a operator's central database, each bit can represent a wide variety of information. Unfortunately, in order to keep their price down, typical RFIDs have little to no security features. "Simple password comparisons are all that can be expected on most current-generation RFID tags." (Molnar, Wagner 211) That means tags will have passwords only a few characters in length and that they have no protection against sophisticated password cracking techniques. Although it is estimated that the cost of implementing tighter security features would only be around a half cent per tag, because they are meant to be mass produced, even a half cent would add up substantially over time. Therefore any information held within a tag used today is incredibly vulnerable to attack.
Why they are used
Proponents of RFID tags believe that they can revolutionize the way the world does business. RFIDs let companies easily keep track of inventories, shipments, and purchases because they can be read much more quickly than traditional bar codes. Instead of scanning each box or item individually, RFIDs allow workers to inventory entire storerooms without even touching a box. They can also be fitted with timer or temperature sensors to ensure that perishable products are still good. Others believe they can hold medical information in case of an emergency, or biometric information for security checkpoints. Finally, many companies are exploring how they can be used to mine customer data so that they can create targeted advertising campaigns and other marketing schemes.
RFID tags have already gained a major foothold in today’s market. The Department of Defense has declared that all military suppliers must tag every single piece of equipment starting the beginning of this year. Obviously, many retailers have also jumped onto the RFID bandwagon. In 2003, the upscale clothing boutique Prada announced that they would attach RFIDs to all pieces of clothing in their Manhattan store. When a customer enters their dressing room, readers would record what items were being tried on, and then a screen inside the room would show fashion show clips of the article with related accessories.
Albertsons, Target, and The Gap have also installed RFID systems of their own. However, these stores have primarily only used them as another way to keep track of inventory. It was not until Wal-Mart announced that it wanted every one of its top 100 suppliers to be using RFID tags on all cases of merchandise by the end of 2005 that the debate over RFIDs truly heated up.
The problem of privacy
In her article about RFID tags, Meg McGinity outlines some of the troubles Wal-Mart had with introducing RFID tags nationwide. Wal-Mart initially asked razor maker Gillette to be the first to tag each and every individual item. Privacy advocates claimed though that if this policy were enacted, Wal-Mart would then know every Gillette product that a customer bought and how he or she paid for it. "Could that information possibly make its way into the wrong hands? It wasn’t long before Wal-Mart backpedaled on the trial." (17) Wal-Mart ultimately decided to scale back its RFID rollout to include only 3 distribution centers and 150 stores nationally.
McGinity raises the main argument that I, as well as many other privacy advocates, have against RFID tags. With RFID tags, a store can learn quite a lot of information about a person without their knowledge or consent. As Jules, Rivest, and Szydlo eloquently put it:
"This presents a clear potential for privacy violations. What woman wants her dress size to be publicly readable by any nearby scanner? Who wants the medications and other contents of a purse to be scannable? Who wants the amount of money in a wallet to be easily determinable by a scanner? Who wants his or her location to be tracked and recorded based on the unique ID number in shoes or other clothing?" (104)
Even if Wal-Mart and other stores promised to keep this information secret, most people, if given the choice, would probably not share such intimate details about themselves. Couple that with the relatively poor data security for RFID tags, and it is possible that any unscrupulous person with a homemade reader could get a very clear picture of someone’s life from them.
Stores are not the only organizations to use RFIDs. Many libraries today are also using them as a way to manage their inventory. RFID systems have already replaced traditional checkout systems in a number of libraries in California, Oregon, and Nevada. Once again this raises serious concerns with privacy advocates. When a book is entered into the collection, it is given a second static ID number. Because the number never changes, a person or organization can use that ID to track the movements of certain books. This technique, called "hotlisting", when combined with traditional methods such as video surveillance, can be used to link together persons of the same group or disposition. Many believe that law enforcement agencies could easily abuse this method if RFIDs become more prevalent. Molnar and Wagner claim:
"Hotlisting is problematic because it allows an adversary to gather information about an individual's reading habits without a court order. For example, readers could be set up at security checkpoints in an airport, and individuals with hotlisted books set aside for special screening. Hotlisting is not a theoretical attack. Recall FBI warnings regarding almanacs as an indicator of terrorist activity." (Molnar, Wagner 213)
Just imagine the type of pressure someone might face if they checked out a book that happened to be hotlisted by the FBI as a terrorist book. Many libraries have electronic systems that delete checkout records so that it would be useless for the FBI to try and seize them later, but RFID tags make it much easier for the FBI and other government agencies to still get the information they want. Normal Americans who have done nothing wrong potentially face an incredible amount of surveillance under this system.
Finally, Frederick S. Lane, in his book The Naked Employee has, discussed some of the issues of using RFIDs in the workplace. Lane believes that it is only a matter of time before some business forces their employees to implant RFIDs into their bodies "as the ideal solution to its security concerns." (63) Although it sounds far fetched, I do not believe it is out of the realm of possibility. I agree with his claim that "it will be hard to justify ...when less invasive and nearly as secure alternatives exist." (63) Few people will be willing to implant electronic devices when ID cards, passwords, and security checkpoints work just as well.
I believe it is more likely though that within the next few years, the government will propose that RFID tracking devices be implanted into sex offenders, child molesters, and other criminals after they are released from prison. The logic behind it is simple enough. We already have a national sex offenders list that is supposed to track their movements and keep the public informed about where they are, therefore tags in each ex-convict will make the system easier to update and manage. However, I still feel this would be ineffective. In the case of both the employee and the ex-prisoner, it can make leading a normal life very hard. Discrimination based on who you are is a very real concern and almost impossible to recognize.
What should be done
In 2003, a study was conducted by George Roussos of the University of London to judge people's reactions to a supermarket run entirely with RFID tags. The system was designed to record all interactions customers had with products both inside the store and inside their homes. At first the results looked promising. People enjoyed the accurate and detailed descriptions the system gave about each product, as well as the ability to keep track of the total cost of their items. People also applauded the in-store navigation system and the speedy checkout lines. But after the study was over, Roussos found that many people simply did not trust the system as a whole. "In fact, consumers expressed substantial reservations about specific aspects of system functionality and often objected strongly to their implementation and use." (Roussos, Moussouri 421) In particular, the people who participated in the study criticized the fact that the system monitored their purchases, proactively notified them of potential deals, and mined data based on their daily activities. It was "perceived as constructing too detailed a picture of one’s life, and indeed one that is hardly ever shared outside one’s immediate family." (Roussos, Moussouri 422) Over half the participants felt the way the system tracked everything they bought in the store and created shopping lists based on those purchases was far more invasive than it was helpful.
In the end, this study should serve as a warning to any business planning on implementing such a system in their own stores. But, as RFIDs become more prevalent in the coming years, we should expect to see more stores like this one. For those of us who do not like the idea of RFID tags tracking our every move, researchers at MIT and RSA Laboratories have come up with an interesting solution, the RFID blocker tag. Basically, any time it comes within the range of a reader, the blocker tag will emit a garbage signal that overrides any normal signals it encounters. The blocker tag can also be set so that it only blocks a certain subset of tags, therefore it will not interfere with non-consumer tags such as shipping and inventory ones. The researchers suggest that the tags be used to set up “privacy zones” where people can feel safe from outside readers. The blocker tag’s privacy zone can be a stationary area like the home or office, or it can be attached to the person’s body, thereby creating a personal RFID dead-zone.
To be honest, I find it rather depressing that it might actually come to this. There is a chance that it won’t though. Carolyn Marvin has done extensive research on the technologies introduced in the late 1800’s and early 1900’s and how society reacted to them. She says that “feared above all for its potential to expose private family secrets was the telephone. Boundaries marking public and private seemed to be in peril as never before.” (68) She reports that the literature of the time suggested the telephone was a serious attack on the family because it permitted people to easily spread secrets with a speed never before possible. Hardly any of us today believes that the telephone is a serious threat today though, so perhaps the same might be true for RFID tags as well. The theme throughout Marvin’s research is that people need time to learn and adjust to new technologies, and that in the end, what is hailed as a serious threat to everyone sometimes tends not to be.
There may be a hint of truth to what Marvin is saying. RFID technology is still in its infancy, so to expect society to have already worked out all of its implications would be quite naïve. It is clear that there are many applications for RFIDs that people honestly enjoy. As the technology gets better and people more become familiar with them, privacy concerns could vanish. At this time however, RFIDs should still be used with caution. The privacy and security concerns over them are just too great right now to justify their widespread use. People are still wary of what they can do and are not willing to accept them yet. As we all learn more about this new technology, more benefits and concerns will arise. The debate is far from over though, so you should expect to hear quite a bit more about RFIDs in the near future.
Lane, Frederick S. The Naked Employee: How Technology is Compromising Workplace Security New York: American Management Association, 2003.
Marvin, Carolyn. When Old Technologies Were New: Thinking About Electric Communication in the Late Nineteenth Century New York: Oxford University Press, 1988.
McGinity, Meg. “RFID: Is This Game of Tag Fair Play?” Communications of the ACM. Vol 47 (2004): 15-18.
Molnar, David and David Wagner. “Privacy and Security in Library RFID Issues, Practices, and Architectures” Proceedings of the 11th ACM conference on Computer and communications security (2004): 210-219.
Jules, Ari, Ronald L Rivest, and Michael Szydlo. “The Blocker Tag: Selective Blocking of RFID Tags for Consumer Privacy” Proceedings of the 10th ACM conference on Computer and communications security (2003): 103-111.
Roussos, George and Theano Moussouri. “Consumer Perceptions of Privacy, Security and Trust in Ubiquitous Commerce” Personal and Ubiquitous Computing Vol 8, Issue 6 (2004): 416-429.
Want, Roy. “Just How Do Those Little Things Work Anyways: The Magic of RFID” Queue (2004): 41-48.
Last modified January 09, 2006 at 11:39 AM