• On MovieTome: See the TRAILER for TERMINATOR 4!

August 30, 2004 4:00 AM PDT

Perspective: Don't regulate RFID--yet

See all Perspectives
  • Print
Don't regulate RFID--yet
Not many people may remember this, but Phil Donahue was one of the digital age's first technophobes.

In 1974, the TV talk show host denounced the Universal Product Code, better known as the bar code, as a dastardly plot that would let grocery stores trick consumers. Grocers would replace price tags with bar codes and confuse shoppers, Donahue informed his viewers repeatedly.

Donahue's predictions turned out to be nonsense, of course, and today, the humble bar code saves Americans more than $17 billion a year in grocery stores alone.

But the technophobe mentality just won't quit. Now a clutch of privacy fundamentalists is calling for new laws to target radio frequency identification (RFID) technology.

RFID tags are microchips that have already shrunk to half the size of a grain of sand--practically.

In a world where we can get a credit card over the phone and open a bank account over the Internet, why require an ink signature on a piece of paper?
They listen for a radio query and respond by transmitting their unique ID code. Most RFID tags have no batteries; they use the power from the initial radio signal to transmit their response.

The technology permits retailers to slim down inventory levels and reduce theft, which one industry group estimates adds up to $50 billion a year. With RFID tags reducing costs for businesses, consumers likely will end up with more choices and lower prices. And wouldn't it be handy to grab a few RFID'd items from store shelves and simply walk out, with the purchase price automatically debited from your (properly secured) RFID-equipped credit card?

There are legitimate privacy concerns about RFID tags, which I outlined in a column more than a year ago. But RFID companies already are proposing solutions, indicating that legislators should be extremely cautious before stepping in with one-size-fits-all solutions.

Instead, sadly, politicos are rushing to regulate. In February, California State Sen. Debra Bowen introduced a bill (SB1834) that seeks to regulate RFID technologies. It originally said that before such tags can be used for information collection, a business "shall obtain written consent."

Even if you agree with her approach, Bowen's approach seems chronologically backward. In a world where we can get a credit card over the phone and open a bank account over the Internet, why require an ink signature on a piece of paper? The only way Bowen's legislation makes sense is if she wants to make a new technology so unwieldy that few people will use it.

Other states have been equally busy. Proposals in legislatures such as Utah (HB251) and Missouri (SB867) would make it illegal to slap RFID tags on products unless consumers know about them. Virginia is considering (HB1304) "policies and guidelines" related to RFID tags, as is Maryland (HB32).

Feds to weigh in?
Congress also has signaled that laws could be on the way. One House subcommittee convened a hearing last month on the topic, where both Republicans and Democrats improbably likened RFID tags to "spyware." Sen. Patrick Leahy, D-Vt., has talked about corporate "excesses" that "suggest that Congress may need to step in at some point." The Federal Trade Commission has convened a workshop on the topic.

Cedric Laurent, a policy fellow at the Electronic Privacy Information Center (EPIC), says the European data protection commissioners are drafting regulations to cover RFID. "They're going to come up with some documents soon," extending the European Data Protection Directive, Laurent said. (Portugal's data protection commissioner is already there.)

Pro-regulation groups like EPIC, the American Civil Liberties Union, Consumers Against Supermarket Privacy Invasion and Numbering (CASPIAN) and Ralph Nader's Consumer Project on Technology are egging politicians on.

One way to eliminate most privacy concerns is to disable RFID tags after they leave the store.
They released a manifesto last November, demanding that merchants "be prohibited from forcing or coercing customers into accepting live or dormant RFID tags in the products they buy." CASPIAN has proposed sample federal legislation that would go even further by flatly outlawing some uses of RFID devices.

That flips the principle of consumer choice upside down. If Wal-Mart Stores eventually begins to sell toasters with RFID tags on the boxes, consumers can choose to remove the tags or shop elsewhere. Sam Walton's focus on customer satisfaction, part of Wal-Mart's corporate culture today, suggests that his company would be extraordinarily sensitive to customers' privacy concerns--even in the absence of specific RFID laws.

First cookies, then...
The legislative approach would set a precedent that should worry Silicon Valley--that tech-impaired politicos and activists can dictate the future of any technology they dislike. Instead of letting normal market forces take over and consumers embrace or reject new ideas, the privacy prohibitionist view says that only technologies approved by Washington or state capitols can be permitted to exist.

That almost happened with "cookies" a few years ago. Know-nothing members of the European Parliament wanted to outlaw cookies, which are records created by your Web browser that permit sites to look the same during your next visit. The Interactive Advertising Bureau UK had to launch a "Save Our Cookies" campaign, and in the United States, class-action lawyers began filing lawsuits of dubious merit against targets such as Excite@Home.

The cookie bans failed when saner heads prevailed--but not until after software companies spent considerable effort providing evidence to politicians that cookies weren't Big Brother in tiny packages. Now the RFID industry is being forced to beg legislators to back off.

"We feel that any efforts to prematurely legislate or regulate the technology before it has a chance to be implemented really will prevent industries from unlocking the benefits of the technology," said Jeff Oddo, a spokesman for the Uniform Code Council, which oversees bar codes and an RFID association called EPCglobal. "A lot of the work that we're doing is to address any concern that (would) prevent this technology from being deployed responsibly. Privacy is as important as anything else we're doing."

One way to eliminate most privacy concerns is to disable RFID tags after they leave the store. Standards organizations such as EPCglobal have specified a "kill command," and 13 companies, including Philips Semiconductors and Texas Instruments, elaborated on it in their own proposal, which would include a 32-bit kill switch. (Except in some pilot projects, RFID tags aren't being placed on individual products, just on pallets used inside stores.)

EPCglobal has published a set of substantial public-policy guidelines that say consumers should be informed of RFID tags and given the option to disable them. The guidelines take effect on Jan. 1, 2005.

In other words, the RFID industry already is responding to consumers in a responsible manner, knowing that retailers will lose business if Americans aren't reassured. Just don't expect the modern-day Phil Donahues to admit it.

Biography
Declan McCullagh is CNET News.com's chief political correspondent. He spent more than a decade in Washington, D.C., chronicling the busy intersection between technology and politics. Previously, he was the Washington bureau chief for Wired News, and a reporter for Time.com, Time magazine and HotWired. McCullagh has taught journalism at American University and been an adjunct professor at Case Western University.

More Perspectives

See more CNET content tagged:
RFID, Debra Bowen, RFID tag, Electronic Privacy Information Center, bar code

Add a Comment (Log in or register) 20 comments
Privacy is eroded one step at a time
by August 30, 2004 6:03 AM PDT
We are told to wait to regulate RFID's and let industry do that themselves. Have you ever heard of that working? If we believe in a RIGHT to privacy, then the operative phrase must not be "buyer beware". Those citizens who are not expert in these fields, don't know they are being "tracked" or don't understand how to find and remove the tags have the same rights to privacy as those of us who do. Walmart may drive the move to make RFID's cost effective, but they aren't the source of worry. Government is persistent in getting more intrusive, and RFID's will be terribly appealing.
Reply to this comment
Maybe...
by bkwest918 August 30, 2004 5:58 PM PDT
I would agree that the Government is the main source of worry here. I don't see RFID being abused much at all if any. Just like with anything a few bad apples can't totally stop you from eating apples now can it? Its all just FUD

Brian
Blind or Ignorant?
by Mister C August 30, 2004 9:40 AM PDT
My guess is this guy has someone else do his shopping for him.
Reply to this comment
Calling Dr. Faraday!
by Catgic August 30, 2004 9:43 AM PDT
Read your August 30, 2004 ?Don't regulate RFID?yet,? and had a few thoughts to share.

Like the ubiquitous UPC bar code, RFID is here to stay, and will also grow to be ubiquitous.

Of course doomsayer Donahue's dire predictions turned out to be nonsense, because any one knows a Bar Code can be render technologically impotent by simply writing a red line through the UPC stripes using a red felt tip or ball point pen. After the UPC is red-lined, a laser Bar Code reader views the red-striped 6 ? 66666 ? 66666 ? 6 ?Mark of the Beast? merely as a non-threatening, apostolic # - ##### - ##### - #, followed by a call for, ?Manager assistance on Aisle 12.?

RFID is here to stay, and will grow by leaps and bounds across the globe because Uncle Sam want to ?tag & bag? everything and everyone in their ?Global Fight Against Terrorism.?

Washable RFID tags sewn into clothing will help parents answer the question, ?It?s 10:00 PM, do you know where you teenager is?? Euro ?Bucks? with RFID by 2005, and the companion pilot U. S. Treasury RFID ?Green Back? program on the ways, will employ globally interoperable RFID ?buck? reading and tracking systems technology. Electronic ?buck? readers will track all point-of-sale ?RFID? tagged cash transactions. Embed one in your driver?s license and in the windshield of your car, and you will never ?drive alone.?

Typical max range for reading an RFID tagged item is about 30-65 feet. So, properly equipped folks can drive down the street in front of your home, inventory the contents of your pantry, your cash-on-hand, your video collection and whatever else you have in your house that is RFID ?tagged & bagged.?

Fear not citizens, Mighty Dr. Faraday will save the day!

Ubiquitous RFID will create a high-growth cottage industry in Faraday cage enclosures. Here are just a couple of examples: Purses and wallets will be styled and fabricated into mini-Faraday shield enclosures using 120dB flexible Mu-copper foil and EMI gasket fingerstrip closures. Upscale homes will no longer have a built in ?Panic Room,? rather they will have ?Faraday Family Rooms? where the family can go to be safe from prying RFID ?eyes.? Of course, 120 dB master bedrooms will become the de rigueur. Depending on how much you can afford or what you are willing to spend per decibel for peace of mind, it is fast becoming a 60-80-100-120 dB world.

Thanks to Dr. Faraday, 21st century technology has things-under-control. But bring in the clowns dressed as class-action lawyers, vote chasing legislators and government bureaucrats. Their ?one-size-fits-all? citizen-privacy-protection ?clown suit? will go well with that old ?decorator? government surplus $600 toilet seat that I bought at government auction for a ?Buck,? a RFID ?Buck? of course.
Reply to this comment
Why is it that the promoters of these types of ideas...
by MTGrizzly August 30, 2004 2:49 PM PDT
...never seem to be able to look at anything other than the
"good" or "positive" ways in which their technology can be used?
Why do they, immediately, counter rational questions, with
irrational statements that nothing will go wrong, if we just
"trust" them?

I have been spending a lot of time on silicon.com, reading about
the ways the Europeans and Japanese are already using, or
planning on using, RFID. It is incredibly frightening.

The English want to use RFID to automatically cite motorists
violating their "congestion zones" using RFID. Never mind the
fact they are having trouble because their number plate pattern
recognition software in use with cameras is "recognizing" and
citing people who could not have possibly been in the location
the software says they were. Can anyone say "forged number
plate" or "computer/human error"? Anyone want to wonder how
long it will take to forge a "RFID" identity the same way?

A company in Germany has found a way to make a person's skin
transmit information processed by a RFID chip - of course, the
chip will have to be implanted. Another company has devised an
RFID chip that can be implanted in "high end" watches, to help
"prove" a watch was stolen. Or, alternatively, if you are a watch
thief, to allow you to scan a watch and find out if it is worth your
while to steal. Of course, in either case, no one will ever think to
falsify the RFID chips.

One Japanese school is now putting RFID chips in their students
and teachers name tags and belongings. Apparently, it is too
much trouble for them to visually ascertain whether the student
is present. Forget about the fact they are depriving minors of
their right to privacy. Stand by for the fun when kids start
swapping name tags and wearing each other's clothes.

Wal-mart, the company that hires illegal aliens to clean their
stores, don't pay them minimum wage or overtime and locks
them in at night, is going to do the "right thing" when it comes
to RFID? They are going to do what is profitable for them and
what they can get away with.

The point of this article seems to be, "Stick you head back in the
sand, don't worry, we will take care of you. Trust us." Quite the
opposite is true, failure to fully question any new technology is
to stick one's head in the sand. Being concerned about
something that will majorly impact our personal freedoms is not
"worry", it is prudence.

It further seems to assert that questioning the benefit and
claimed lack of danger from RFID makes one, somehow, a
Luddite. Questioning whether change is good or bad does not
mean one is opposed to technology. It means one is opposed to
allowing negative consequences to befall them and is willing to
take steps to avoid just that.

All emotional, political and religious arguements about RFID
aside, this is about money. How much money can we make from
this latest gadget we invented. In our society, technology
advances in a vacuum - the morality and actual usefullness of a
product is never considered while a technology is under
development; once it is developed, people assume they have a
right that supersedes the rights of all others to make money off
a product, irregardless of how it affects other people. Marketing
merely steps into that vacuum, continues it, and markets
technology without a thought as to it's adverse effects.
Reply to this comment
Theft Prevention=RFID Disabling Tech
by markdoiron August 30, 2004 3:16 PM PDT
okay, i'd like as much as the next person to reduce theft such that the price i pay at a retail store is the cost of the item, not the cost plus shrinkage (from theft). however, if i buy a jacket with an rfid chip, it MUST be disabled, right? after all, what happens when i walk in that same store (or another??) next week wearing that jacket? will i be tagged a thief or charged for the purchase? since even the most rudimentary thinking reveals that at least some rfid chips must be disabled (ie, those on products we're likely to wear/carry into rfid'd environs in the future), why can't the stores just make it policy that ALL rfid chips are disabled at checkout? period. end of discussion. no reason to suggest that the industry do the right thing because, to be quite honest, there's no way this will work if they don't!

mark d.
Reply to this comment
but some chips are read/write
by August 31, 2004 6:26 AM PDT
Some Passive chips are read write so that when you purchase that jacket the sales system would record on the chip that it has been purchased. The store could then further track and target ads about similar jackets to you through screens with scanners looking at the chips you are wearing.
Scared of RFID? I can think of other stuff to be scared of!
by bkwest918 August 30, 2004 3:26 PM PDT
I'm not. If you are scared of RFID you are not thinking. You should be more worried about E911 or even the Patriot ACT. Then you do something very silly like post a comment on this story which you have to register with... yet you complain about it. RFID is good... Just live with the fact that technology will always be 100 years ahead of the law.

Thanks,
Brian West
Reply to this comment
The issue is not "fear" or the "law"...
by MTGrizzly August 30, 2004 3:52 PM PDT
The issue is civil rights. Yes, the law takes a long time to catch
up with technology. Some might even be able to argue it has
never, truly, been able to catch up with it.

Yes, E911 and the Patriot Act are egregious infringements on
personal privacy. So is OnStar, (sorry, GM, I am not willing to
trade my responsibility for not locking the keys in my car for the
loss of privacy of carrying a lojack around). RFID is just one
more step on a slippery slope leading to the loss of individual
freedom and civil liberties.

On a daily basis, because of technology and other reasons, we
face life in a society where privacy is steadily eroding. I am not
willing to sacrifice any more of my rights - esp. when it is for
incredibly dubious benefits, like Wal-mart making more money.
View reply
Most of these bills make perfect sense
by ajbright August 30, 2004 4:07 PM PDT
First of all, why should anyone be allowed to record personal information, via any medium, without your written consent? Personally I think this would be one sure way to reduce the amount of junk telephone calls, junk mail and junk email you'd receive.

Buying something shouldn't mean automatically placing you on a mailing list. Mailing lists are of benefit to no one except mass marketers.

Secondly, why shouldn't stores be forced to inform customers that they are using this technology.

Whether they decide to use the technology or not, just advertising that they are could in itself reduce shop lifting. It's like the false warnings about speed and traffic light cameras in England. The warnings are posted, but the cameras may or may not be there. However there are sufficient numbers of actual cameras installed that the mere presence of a warning sign slows drivers down and reduces the number of red light runners.

So it seems to me that the more legislation used to limit anything that can directly or indirectly record personal information the better.

I can't think of a single reason why I'd want anyone to be able to record any of my personal information.

It's my information, and the only person that should benefit from it's sale is me. I'm already doing the merchant a favour by purchasing from their store and I fail to see why my information should be a necessary part of the transaction - unless they are willing to offer me hard cash in return. After all, that's what ends up happening with this data - it's sold to mass marketers, who in turn sell it to their clients over and over again.

No privacy policy is worth the paper it's written on. They are not legally binding, and they certainly shouldn't be trusted.
Reply to this comment
What about your bills, credit cards and such?
by bkwest918 August 30, 2004 6:00 PM PDT
Ok if nobody should be allowed to record anything about you how do you think place like the cable, phone and power companies could bill you? They do have to collect some level of personal information to function. You did have to register to post.. that information was recorded somewhere along with your IP...

Brian
View all 3 replies
Loss of what, exactly..? How about this..?
by Raife August 30, 2004 9:35 PM PDT
.
First, unless you are 'deaf', 'dumb' and 'blind', it has been CLEARLY demonstrated that "...normal market forces..." ARE A JOKE. They do not work, when 'powerful-interests' (and the 'politicians' they OWN) 'smell' more money, and/or the potential for greater control over 'the public' (this is, simply, history).

The reason that we have to resort to such 'laws' (and why we, as a society, have laws in the first place) is because such "...forces" have PROVEN, time and time again, that left on their own, ...they WILL NOT show restraint, ...they WILL do WHATEVER they are ALLOWED to 'get-away-with' (again, that is just history).

Furthermore, this type of technology truly does have the potential to be a DEVASTATING-FORCE against PRIVACY, and numerous personal-FREEDOMS (Only a fool hands a 'LOADED-GUN' to someone that has repeatedly proven their UNRELIABILITY, and hopes to deal with the consequences, ...after the fact).

On a 'personal' side-note... I live in a relatively small town where there are now 'government video-surveillance cameras' on nearly every 'street-corner'. When these 'devices' were first installed (and as more and more 'locals' began complaining about the 'loss of privacy') the 'Dept. of Transportation' officially stated that the 'cameras' were actually, "...just part of the 'traffic-light' control system". Then, someone stepped forward and flatly stated that they had installed these 'cameras' before, ...and that they were, in fact, for surveillance. I didn't know what to think, until I one of the men that actually changes the surveillance-tapes, moved-in next-door to me.

Later, these 'rubber-trapezoids' began appearing on streets throughout the city. Once again, a plausible explanation was offered by the city. "They are weather-monitors, used to remotely detect 'road-conditions'". This seemed reasonable, ...except that, more and more of these things have been cropping-up. And, yesterday, ...while driving through town, I noticed that there was a "weather-monitor" in the middle of EVERY SINGLE LANE, on ALL FOUR-SIDES of every intersection. Talk about over-zealous enthusiasm for the weather... Makes you wonder.

And, by the way, The very shoes that I am now wearing have an 'anti-theft' device built, permanently, into them. I know this because MY SHOES (which I had LEGITIMATELY PURCHASED) set-off alarms in every 'major-store' that I entered for weeks after I BOUGHT THEM (it finally took a 'security-guard', at a different store, over TEN-MINUTES to 'de-activate' the 'security-device', just so I could exit the store without being searched).

If, these ARE 'reasonable' actions, then WE would be allowed to CHOOSE which of these 'technologies' we were subjected to, And, the 'public' would NOT have to be LIED TO.

So, Yeah, ...I don't see a problem here.
.
Reply to this comment
Its not the Toasters, it's the Cloths!
by August 31, 2004 5:28 AM PDT
Its not the rfid chips in the tosters that go home and stay home -- its the chips in the credit cards, jeans, shirts, jackets that can be used to track you as you go into and wander around stores. -- and then tie it all to your personal information.
Reply to this comment
Clothes?
by September 1, 2004 9:53 AM PDT
Deactivating tags is easy. 10 seconds in the
microwave should do it.
advertisement

Latest tech news headlines

RSS Feeds

Add headlines from CNET News to your homepage or feedreader.

More feeds available in our RSS feed index.

Markets

Market news, charts, SEC filings, and more

Related quotes

Wal-Mart Stores (4.46%) 2.26 52.92
Dow Jones Industrials (6.54%) 494.13 8,046.42
S&P 500 (6.32%) 47.59 800.03
NASDAQ (5.18%) 68.23 1,384.35
CNET TECH (5.95%) 56.25 1,002.00
  Symbol Lookup
advertisement

Inside CNET News

Scroll Left Scroll Right