History

RFID systems have gained popularity, and notoriety, in recent years. A driving force behind the rapid
development of RFID technology has been the rise of pervasive commerce, sometimes dubbed the quiet
revolution. Pervasive commerce uses technologies such as tracking devices and smart labels embedded
with transmitting sensors and intelligent readers to convey information about key areas where
consumers live and work to data processing systems. To gather this data, retailers can choose from a
range of options.

RFID systems may be roughly grouped into four categories:

 EAS (Electronic Article Surveillance) systems: Generally used in retail stores to sense the
presence or absence of an item. Products are tagged and large antenna readers are placed at
each exit of the store to detect unauthorized removal of the item.
 Portable Data Capture systems: Characterized by the use of portable RFID readers, which
enables this system to be used in variable settings.
 Networked systems: Characterized by fixed position readers which are connected directly to a
centralized information management system, while transponders are positioned on people or
moveable items.
 Positioning systems: Used for automated location identification of tagged items or vehicles.

These RFID systems enable business owners to have real-time access to inventory information, as well
as a broader, clearer picture of consumers' buying habits. RFID technology also enables retailers and
corporations to peek into the lives of consumers in ways that were, until recently, off limits. Products
embedded with RFID tags can continuously transmit information ranging from an electronic product code
(EPC) identifier, to information about the item itself, such as consumption status or product freshness.
Data processing systems read and compile this information, and can even link the product information
with a specific consumer.

This composite information is vastly superior-and more invasive-than any data that could be obtained
from scanning bar codes, or even loyalty cards. Frequent shopper cards link consumers to their
purchases, but this limited information gives retailers only a narrow view of a consumers' in-store
purchasing trends. In contrast, RFID systems enable tagged objects to speak to electronic readers over
the course of a product's lifetime-from production to disposal-providing retailers with an unblinking,
voyeuristic view of consumer attitudes and purchase behavior.

The future of RFID technology

Currently, RFID technology is still too expensive to be used by retailers en masse. The cost per
electronic tag now stands at about 30 cents apiece, but is expected to fall to as little as three cents in
the next three years. RFID tags will probably not become pervasive until the per chip cost dips below
one penny. Retailers will still have to purchase sensors to read the tags, which can cost $1,000 each.

In spite of the costs, some retailers are willing to pay the price for the insight RFID tags provide into the
lives of consumers. Over the next few years, industry experts expect to see a broad range of RFID
pilots, and even several fully integrated systems, launched. A handful of corporations have already
signed on, and are moving ahead with plans to embed products with RFID tags. Recently, Microsoft
Corporation announced that it would develop software that will enable retailers, manufacturers, and
distributors to use RFID tags to track goods within stores and factories, as well as programs specifically
designed to use the new retail tagging technology.

Other proposed uses of RFID technology include:

 Tracking apparel: Clothing maker Benetton planned to embed retail items with RFID tags. The
implanted devices would enable Benetton to track individuals and inventory their belongings by
linking a consumer's name and credit card information with the serial number in an item of
clothing. Privacy advocates noted the potential abuses of a system, and Benetton agreed not to
tag clothing with tracking devices-for now.

However, Marks & Spencer, one of the largest retailers in the UK, announced that it will begin
tagging apparel items with ultra high frequency (UHF) tags beginning in Fall, 2003. UHF tags
are a new generation of RFID technology that provide faster data transfer speeds and longer
 read ranges. Marks & Spencer has already used tracking devices extensively in its food supply
division.

 Tracking consumer packaged goods (CPGs): Gillette, Wal-Mart, and the U.K.-based supermarket
chain Tesco are teaming up to test specially designed shelves that allow for real-time tracking of
inventory levels. The "smart shelves" will be able to read radio frequency waves emitted by
microchips embedded in millions of shavers and other products. Wal-Mart plans to test the
Gillette shelf initially in a store located in Brockton, Mass. If the technology is successful, Wal-
Mart also plans to join forces with Procter & Gamble to test a similar system with cosmetic
products, and has encouraged its top 100 suppliers to use wireless inventory tracking
equipment by 2005. So far, Wal-Mart executives say the company plans to use RFID chips only
to track merchandise, and will remove the tags from items that have been purchased. However,
Wal-Mart's decision to implement RFID technology will likely propel the ubiquity of the tags in
CPGs.
 Tracking tires: Tire manufacturer Michelin recently began fleet testing of a radio frequency tire
identification system for passenger and light truck tires. The RFID transponder is manufactured
into the tire and stores tire identification information, which can be associated with the vehicle
identification number (VIN). Critics argue the tags could ultimately become tracking devices that
can tell where and when a vehicle is traveling.
 Tracking currency: The European Central Bank is moving forward with plans to embed RFID
tags as thin as a human hair into the fibers of Euro bank notes by 2005, in spite of consumer
protests. The tags would allow currency to record information about each transaction in which it
is passed. Governments and law enforcement agencies hail the technology as a means of
preventing money-laundering, black-market transactions, and even bribery demands for
unmarked bills. However, consumers fear that the technology will eliminate the anonymity that
cash affords.
 Tracking patients and personnel: Alexandra Hospital in Singapore recently began a new tracking
system in its accident and emergency (A&E ) department in the wake of the Severe Acute
Respiratory Syndrome (SARS) scare. Under this system, all patients, visitors, and staff entering
the hospital are issued a card embedded with an RFID chip. The card is read by sensors
installed in the ceiling, which record exactly when a person enters and leaves the department.
The information is stored in a computer for 21 days. Officials say that the technology enables
health care workers to keep tabs on everyone who enters the A&E department, so that if
anyone is later diagnosed with SARS, a record of all other individuals with whom that person
has been in contact can be immediately determined. Other hospitals in Singapore are expected
to adopt similar technology.
 Payment systems: In 1997, ExxonMobil developed the wireless payment application known as
Speedpass. Since then, six million consumers have utilized the payment option at 7,500
Speedpass-enabled locations. Now, a wide range of merchants and retailers are looking for
ways to implement radio frequency (RF) wireless payment systems. Sony and Phillips are
leading the way. The two corporations will soon begin field testing an RFID system called Near
Field Communication (NFC), which will enable RFID communication between PCs, handheld
computers, and other electronic devices. The companies envision that consumers will log on to
their personal online portal by swiping their smart cart-embedded with a Sony or Philips RFID-
which will be read by a RFID reader plugged into the USB port on the computer. Next,
consumers would shop online, say, for tickets to a local event. The consumer would pay for the
tickets online, download them to their PC and then transmit them with NFC technology to an
RFID tag in their mobile phone. Then, at the event, consumers would wave their cell phone near
a reader in the turnstile, and be automatically admitted.

What You Can Do to Protect Your Privacy

While corporate giants tout the merits of RFID technology, civil liberties advocates point out that the
ability to track people, products, vehicles, and even currency would create an Orwellian world where law
enforcement officials and nosy retailers could read the contents of a handbag-perhaps without a
person's knowledge-simply by installing RFID readers nearby. Such a fear is not unfounded. Currently,
some RFID readers have the capacity to read data transmitted by many different RFID tag. This means
that if a person enters a store carrying several RFID tags-for example, in articles of clothing or cards
carried in a wallet-one RFID reader can read the data emitted by all of the tags, and not simply the
signal relayed by in-store products. This capacity enables retailers with RFID readers to compile a more
complete profile of shoppers than would be possible by simply scanning the bar codes of products a
consumer purchases.

Even the RFID industry itself is aware of the threat to privacy posed by the development and installation
of tags in commonplace items. Consumers Against Supermarket Privacy Invasion and Numbering
(CASPIAN) recently located internal public relations documents which detail how RFID developers plan to
offset public opposition to the technology. The documents, prepared by Fleishman-Hillard, a
communications consultancy, suggest that RFID industry leaders are planning a public relations
campaign designed to counter opposition to the pervasive use of RFID technology. The documents
detailing how such a campaign may unfold begin by outlining obstacles that hinder the widespread
implementation of RFID technology. These obstacles include the facts that: "consumers are very
concerned about invasions of their privacy," are "cynical about the government and private sector's
commitment to protecting privacy," and are "inclined to believe that businesses have little incentive to
protect consumers' personal information." In response, the documents cite the need for the
development of a proactive plan that would "neutralize opposition" and "mitigate possible public
backlash." One method of doing so suggested by the documents is through the creation of a Privacy
Advisory Council made up of "well known, credible, and credentialed experts" who may be "potentially
adversarial advocates." The documents cite EPIC as an example of such a potential council member.
Although EPIC has been approached by others on this issue, EPIC will not serve on such a council or
consult for other companies.

The proposed uses of RFID tags pose exponentially greater risks to personal privacy. Many technology
experts predict the development of a seamless network of millions of RFID receivers strategically placed
around the globe in airports, seaports, highways, distribution centers, warehouses, retail stores, and
consumers' homes, all of which are constantly reading, processing, and evaluating consumers behaviors
and purchases. In addition to undermining a consumer's ability to enjoy a lifestyle in relative anonymity,
critics of the technology counter that the information gathered by RFID readers could be obtained by the
government for surveillance or monitoring the activities of citizens, or even misused by hackers and
criminals. Even more, the ever-expanding use of RFID chips would leave no aspect of life safe from the
prying eyes of retail and corporate giants. Chips integrated into commonplace products such as floor
tiles, shelf paper, cabinets, appliance, exercise equipment, and grocery and packaged products would
allow even our most intimate activities to be monitored.

Opponents of RFID tags have proposed measures to side-step the chips' relentless information-
gathering, ranging from disabling the tags by crushing or puncturing them, to simply boycotting the
products of companies which use or plan to implement RFID technology. One way to destroy the tags is
to microwave them for several seconds. Another method is to obstruct the information gathered by RFID
readers by using blocker tags. When carried by a consumer, blocker tags impair readers by simulating
many ordinary RFID tags simultaneously. Blocker tags can also block selectively by simulating only
designated ID codes, such as those issued by a particular manufacturer.

In an attempt to soothe consumers' fears, companies have argued that most items tagged with RFID
chips can't be tracked beyond an operating distance of about five feet. However, while this may be true
today, industry experts say plans for building far more sensitive RFID signal receivers are in the works.

As RFID technology becomes more advanced, consumers may ultimately lose all ability to evade
products implanted with chips. Corning researchers have developed tiny, barcoded beads that are
invisible to the human eye. The microscopic beads can be embedded in inks to tag currency and other
documents, and even attached to DNA molecules. They can also be added to substances like automobile
paint, explosives, or other products that law enforcement officers or retailers have a strong interest in
tracking. Researchers say the technology could be ready for commercial use in three to six years.

EPIC Resources

 EPIC Response to Request for Analysis of New Hampshire's HB 686, Concerning RFID
Technology (pdf) (April 14, 2008)
 Melissa Ngo, EPIC Senior Counsel, Testimony on "SB 293 and RFID Technology" before the
Alaska Senate Judiciary Committee (pdf) (March 17, 2008).
 EPIC Guidelines on Medical Use of RFID Technology (PowerPoint) (2005)
 EPIC Guidelines on Commercial Use of RFID Technology  (pdf) (2004)
 EPIC's VeriChip page
 EPIC's Children and RFID Systems page

Resources
 Digital Security research group from the Dutch Radboud University: page on RFID (July 2008).
 Cryptography analysis of the secret Cypher that the Mifare Classic RFID chip uses (July 2008).
 Office of the Privacy Commissioner of Canada, Consultation Paper, "Radio Frequency
Identification (RFID) in the Workplace: Recommendations for Good Practices" (March 2008).
 ANEC & BEUC, "Consumers' Scenarios for a RFID Policy: Joint ANEC/BEUC Comments on the
Communication on Radio Frequency Identification (RFID) in Europe: Steps Towards a Policy
Framework" (July 2007).
 National Institute of Standards and Technology, "Guidelines for Securing Radio Frequency
Identification (RFID) Systems" (Apr. 2007).
 Commission of the European Communities, "Communication from the Commission to the
European Parliament, the Council, the European Economic and Social Committee and the
Committee of the Regions: Radio Frequency Identification (RFID) in Europe:Steps Towards a
Policy Framework" (Mar. 15, 2007).
 Article 29 Data Protection Working Party, Working document on data protection issues related to
RFID technology (Jan. 1, 2005).
 Food and Drug Administration, "Radiofrequency Identification Feasibility Studies and Pilot
Programs for Drugs - Guidance for FDA Staff and Industry - Compliance Policy Guides" (Nov. 16,
2004).
 Ontario Information and Privacy Commissioner, Tag, You're It: Privacy Implications of Radio
Frequency Identification (RFID) Technology (Feb. 2004).
 Materials submitted at the Massachusetts Institute of Technology RFID Privacy Workshop (Nov.
2003).
 International Conference of Data Protection & Privacy Commissioners, Resolution on Radio-
Frequency Identifiation (Nov. 20, 2003).
 Cynthia Leonardatos, Paul H. Blackman, & David B. Kopel, Smart Guns/Foolish Legislators:
Finding the Right Public Safety Laws, and Avoiding the Wrong Ones, 34 Conn. L. Rev. 157, (Fall,
2001).
 Timothy P. Terrell, Anne R. Jacobs, Privacy, Technology, and Terrorism: Bartnicki, Kyllo, and the
Normative Struggle Behind Competing Claims to Solitude and Security, 51 Emory L.J. 1469,
(Fall, 2002).
 CASPIAN (Consumers Against Supermarket Privacy Invasion and Numbering) is an information
clearinghouse and resource for community and national action opposing consumer tracking
devices, such as loyalty cards and RFID tags.
 CASPIAN has proposed federal legislation known as "RFID Right to Know Act of 2003," which
calls for mandatory labels on RFID-equipped products so that consumers can identify and make
informed choices about purchasing products installed with tracking chips. CASPIAN issued
a press release outlining the proposed legislation on June 11, 2003.