Friday, 14 November 2003
Call for moratorium on RFID tagging of consumer products
In a Position Statement on the Use of RFID on Consumer Products released today, a wide range of privacy and consumer organizations and advocates (including myself) have called for, "a voluntary moratorium on the item-level RFID tagging of consumer items until a formal technology assessment process involving all stakeholders, including consumers, can take place."
Radio Frequency Identification (RFID) is an item-tagging technology with profound societal implications. Used improperly, RFID has the potential to jeopardize consumer privacy, reduce or eliminate purchasing anonymity, and threaten civil liberties.... The development of this technology must be guided by a strong set of Principles of Fair Information Practice, ensuring that meaningful consumer control is built into the implementation of RFID.... Some uses of RFID technology are inappropriate in a free society, and should be flatly prohibited. Society should not wait for a crisis involving RFID before exerting oversight.
RFID tags are tiny computer chips connected to miniature antennae that can be affixed to physical objects. In the most commonly touted applications of RFID, the microchip contains an Electronic Product Code (EPC) with sufficient capacity to provide unique identifiers for all items produced worldwide. When an RFID reader emits a radio signal, tags in the vicinity respond by transmitting their stored data to the reader. With passive (battery-less) RFID tags, read-range can vary from less than an inch to 20-30 feet, while active (self-powered) tags can have a much longer read range.
Publication of the joint position paper coincides with an important RFID Privacy Workshop tomorrow at MIT (to be Webcast by the MIT Media Lab). I won't be able to be there, but I fully endorse the statement, and look forward to the outcomes of the workshop and to more coordinated national organization and education on RFID. (I'll be on my way to Orlando, Florida for the 10th annual PhoCusWright Executive Conference , where'll I'll get to find out what's new in the Internet travel business, and what -- if any -- changes the travel industry is making in response to consumer concerns about privacy, surveillance, and the jetBlue scandal.)
For better or worse, RFID technology (1) is on the brink of widespread, potnetially near-universal, deployment by businesses and goverment, and (2) has potentially profound implications for privacy, anonymity, surveillance, and civil liberties. For more, see CASPIAN's Stop RFID Web site and Database Nation author Simson Garfinkel's RFID Privacy blog , as well as the other endorsers of the statement.
Some of the most problematic uses of RFID would relate to travel, and the potential that items with RFID chips carried by travellers could be used for monitoring, surveillance, and recording of travellers' movements, possibly without their knowledge. And use of RFID in either tickets and payment devices (as is already being done by some transit and toll-road systems) or in government documents (such as passports , visas, or even paper money with remotely-readable serial numbers), could make it impossible to travel at all without RFID tracking -- precluding any opportunity to give or withhold consent, except by staying home.
Although the joint position statement is concerned primarily with RFID in consumer products, it concludes with this note:
Link | Posted by Edward on Friday, 14 November 2003, 18:02 ( 6:02 PM)
Although not examined in this position paper, we must also grapple with the civil liberties implications of governmental adoption of RFID... As an open democratic society, we must adopt a strong policy framework based on Principles of Fair Information Practice to guide governmental implementation of RFID.