Techsploitation
By Annalee Newitz
You're
wearing it
WHENEVER YOU TALK to people about radio frequency identification
(fondly known as RFID), they always start by saying, "This is actually
a really old technology." RFID was invented about three decades
ago, but apparently its time has come.
RFID tech consists of two parts: a tag and a reader. The tag is a microchip
with a teensy antenna on it that talks to the reader, which is a small
device that takes whatever data the tag sends it and passes it along
to a computer. If your RFID tag is in a piece of hospital equipment,
for example, the reader might "talk" to it and tell a database,
"The machine that goes ping is in room seven." Then any hospital
staff who queried the database would know exactly where to get the machine
that goes ping.
RFID isn't some kind of wacky technology of the future, either. You
may actually already be using it in your car if you have one
of those devices that send out a signal and debit your bank account
when you drive through a tollbooth. Cities like Boston, San Francisco,
and New York are making their toll booths compatible with RFID systems
like E-ZPass and FasTrack.
But the most promising applications for RFID systems are in retail.
And this is what groups like the Auto-ID Center at the Massachusetts
Institute of Technology are banking on. Like a handful of other research
and development outfits, Auto-ID is hoping stores will adopt RFID as
the ultimate inventory tool and a safeguard against theft. With readers
on every shelf, you could know every time someone removed a box of Wheaties
from aisle 10. Potentially, every object in a store could have its own
RFID the same way they all have bar codes now. But unlike bar codes,
RFIDs can be read at a distance, and each tag has a unique identifier.
For privacy advocates, the idea of having a unique identifier on everything
they buy is a nightmare. If RFID readers become ubiquitous which
RFID manufacturers bet they will it could mean that every time
you pass by a reader, it could "talk" to your sweater and
shoes. Match up credit card records with your sweater's ID and presto:
it's a system for monitoring your every move.
Harvard psychology graduate student Katherine Albrecht has formed a
group, Consumers Against Supermarket Privacy Invasion and Numbering
(CASPIAN), that's devoted to fighting companies that want to put RFID
tags in their products(www.nocards.org).
Her most recent target was Benetton, the Italian clothing manufacturer,
whose executives announced they would be putting the tags in
their merchandise. After threatening a "Boycott Benetton"
campaign, CASPIAN supporters were elated to hear the company had
withdrawn its promise to use RFID at least for now. Meanwhile,
Prada already uses RFID for merchandise in its SoHo store in New York.
The question is, are RFIDs all nastiness with no killer app? Simson
Garfinkel, a computer security expert and consultant with Auto-ID, says
the technology will serve a useful purpose. He argues that the chips
can be programmed with "kill code," or a single command to
die. Sanjay Sarma, a professor of mechanical engineering at MIT and
cofounder of Auto-ID, suggests stores might send RFID tags these kill
codes at the point of purchase so that the devices would not be used
for tracking. Garfinkel adds that one could be even more clever and
just kill the RFID's unique identifier. Keeping other identifiers in
the chip, such as what the item is, could be useful for people who are
blind and want to use a reader to identify medicines in their cabinet.
RFID tags could also aid robots in sorting recycled materials, or people
who want to ping their refrigerators to find out if they need to pick
up some milk.
Both Garfinkel and Sarma are quick to point out that Auto-ID has a
committee of advisors who are researching the potential abuses of RFID,
as well as exploring ways of getting the industry to deploy it in
a manner that preserves privacy rights. Sarma recently published a paper
(www.rsasecurity.com/rsalabs/cryptobytes/CryptoBytes_March_2003_lowres.pdf)
in which he and his coauthors painstakingly detail all of the ways RFID
could lead to privacy and security violations. Of course, not all RFID
developers may be quite as concerned with civil liberties as the researchers
at Auto-ID are. Intermec, the company whose IntelliTag RFID system was
slated for Benetton shirts everywhere, makes no mention of privacy concerns
in any of its four white papers on RFID and related technologies.
"There's a huge privacy issue that's being ignored here,"
Garfinkel concludes. "And that's the RFIDs in [cars that use] E-ZPass.
Those can already be used to track your movements everywhere."
In fact, transit authorities in several cities use E-ZPass tags as a
way to measure traffic flow. In other words, people are reading the
RFID in your car without your knowledge. I'm just worried flashy campaigns
like CASPIAN's proto-Benetton boycott will distract us from the real
issue: RFID is out there now. The cat is out of the bag. When are we
going to start regulating it?
Annalee Newitz (uniqueidentifier@techsploitation.com)
is a surly media nerd whose kill code seems to work best on trackball
mice, television remotes, and cell phones. Her column also appears in
Metro, Silicon Valley's weekly newspaper.