The recent push to replace UPC barcodes on all consumer goods with RFID tags has resulted in a backlash by privacy activists. Legislation to regulate RFID technology has been introduced in several states. Such regulation could stunt this fledgling technology. While some concerns might have merit, most are exaggerated. This is so especially because the tracking capabilities of RFID have been overstated by both its detractors and proponents. Before we regulate, we should first confirm that privacy fears are not baseless and will not be constrained by market forces. We should be more concerned by government use of RFID—something to which privacy advocates have paid little attention.
New technologies reliably rouse old privacy concerns. The newest technology to inflame the passions of privacy advocates is radio frequency identification (RFID). Specifically, an industry movement to replace barcodes on consumer goods with RFID tags has raised concerns that businesses will link individual identities to uniquely numbered items and thereby track peoples’ movements. Lawmakers around the country have taken notice and have begun to introduce legislation that would constrain the new technology.
But RFID technology is not as all-powerful as its detractors—or its proponents—claim. Concerns over RFID-equipped burglars and GPS-like tracking capabilities are exaggerated. However, concerns that are more legitimate are a continuation of the debate over the collection of consumer data. RFID is simply the new player in this game and its emergence does not substantively change the existing debate. Nevertheless, proposed regulations aim directly at RFID and, if enacted, could stunt the technology’s development.
Part I of this article explains RFID technology and outlines its private and governmental applications. Part II analyzes the concerns espoused in the media and in the legal literature by privacy advocates, and shows that these concerns are overstated. It also notes that while the most legitimate privacy concerns over RFID center on government use and misuse of the technology, activists and legislators have paid relatively little attention to that side of the issue. Part III surveys proposed RFID legislation and explains why regulation is unnecessary given that existing privacy laws and market forces will keep improper uses of the technology in check.
Radio frequency identification (RFID) systems are a subset of a larger class of technology known as automatic identification (Auto-ID) systems. Other Auto-ID systems include such common technologies as barcodes, smart cards, and optical character recognition systems. The purpose of these technologies is to identify and track people, animals, and goods.
For example, a bag of potato chips might have a Universal Product Code barcode printed on it. Scanning the barcode with a laser beam at checkout allows a cash register to easily identify the product and ring the correct price. Behind the scenes, the same barcode might be printed on cases or palettes of the potato chips. Scanning the code at different points in the supply chain helps producers, distributors, and retailers manage inventories and track deliveries. Similarly, a smart card might give someone access to a building by identifying the person at the main door. The same identification process can track which doors the person unlocks within the building and at what time. Such an automated identification system could also be programmed to open only certain doors depending on whose card is presented.
While a barcode requires line-of-sight scanning, and smart cards require physical contact with a reader, RFID-tagged objects can be identified at a distance. Not only is this more convenient, but a contactless design also results in less wear and tear. RFID systems are also faster and more secure than other Auto-ID technologies. Even though RFID tags were invented in 1969 and patented in 1973, the technology is only now becoming technologically and commercially viable.
RFID systems have two main components: a transponder and a reader. Transponders are the data-carrying device in an RFID system and are usually referred to as RFID tags. The transponder is affixed to the object to be identified—anything from a bag of potato chips to a contactless smart card key. The reader is a radio transceiver that communicates with the transponder via radio waves. RFID tags are tiny chips composed of an electronic circuit attached to an antenna. They can be as small as 0.3 millimeters square—about half the size of a grain of sand. The electronic circuit of an RFID tag has memory where data can be stored. RFID tags are always listening for radio signals sent by RFID readers. When a transponder receives a certain radio query, it responds by transmitting the unique ID code stored in its memory back to the reader.
RFID tags can be active or passive. Active tags have batteries that provide them with power, while passive tags do not. Having a battery allows an active tag to broadcast its signal farther than a passive tag and reduces the reader’s power requirements. Passive tags are powered by the radio signals from the reader that wakes them and requests an answer, but this means that their broadcast range is relatively short and that they require higher-powered readers. Active tags are necessarily bulkier than passive tags, so the smallest RFID tags are passive. The batteries on active tags last from two to seven years and add significantly to the cost of the tags, while passive tags last up to twenty years and are relatively inexpensive.
RFID tags also operate at different frequencies, which determine their broadcast range and data transfer speed. RFID systems are classified as low- and high-frequency systems. Low-frequency tags are used for applications that require shorter read ranges like security access keys, inventory management, checkout scanning, and payment systems. High-frequency systems are used for applications that require longer read ranges, such as highway toll-collection and cargo container tracking. While high-frequency tags transmit data faster and can be read from farther away, they also consume more power and are more expensive than low-frequency tags.
Finally, RFID tags can be read-only, read-write, or a combination in which some data (such as a serial number) is permanently stored, while other memory is left for later use. For a tag to be read-write, it generally must be active and have its own power source. Read-only tags are typically passive and are pre-programmed with a unique set of data (usually 32 to 128 bits) that cannot be modified. Read-only tags most often operate as a “license plate” much like barcodes. The “license plate number,” when scanned into a computer, will correspond to an entry in a database containing modifiable product-specific information.
RFID readers are made up of one or more antennas used to send and receive information from tags, and a processor to decode received data. Collected data is passed via cable or Wi-Fi to a host computer system running identification or tracking software. Readers can be portable or they can be fixed and positioned at strategic points, such as dock doors or points on an assembly line, where they will be able to identify the tags that come into their range.
This paper will focus on passive, low frequency, read-only RFID tags, because these are the tags currently being considered for widespread commercial use. They are the smallest and cheapest type of tags, and they meet the requirements of most commercial applications, including consumer product tracking—the use that has raised the most privacy eyebrows.
Imagine you are shopping on Fifth Avenue. You walk into a boutique and look around for a new dress. A sales clerk notices you eyeing a particular red number and says he would like to tell you more about it. He takes a handheld device that looks much like a PDA and points it at the dress. An instant later, flatscreens light up to show video of a model in the dress sashaying on a catwalk in Paris. Designer sketches and color swatches also appear and you notice a shade of blue that you like. Looking at his handheld for just a moment, the clerk confirms that the dress in blue, and in your size, is in stock; he’ll have someone bring it out.
Shoppers at the New York flagship store of Italian fashion house Prada did not have to imagine; such an experience was made possible using RFID. Every garment, shoe and bag in the store was tagged with an RFID chip. Handheld devices were linked to a real-time inventory system to let clerks know what colors and sizes were stocked. Dressing rooms had RFID-reader-equipped racks on which customers could hang the clothes they wanted to try. The racks knew which garments had been selected and displayed interactive information about them on the dressing room’s touchscreen.
This high-tech gadgetry can mean not just convenience for the customer, but also increased sales for the retailer. Less-exclusive retailer the Gap has found that it can increase sales in RFID-equipped stores by 7 to 15 percent by freeing sales staff to spend more time with customers and less time in the stockroom. Although the Prada über-tech experiment was ultimately not completely successful, other retailers, including Abercrombie & Fitch, plan to roll out new RFID stores. And while most of the buzz surrounding RFID is in the private sector, government agencies are taking note of the technology.
Less exotic commercial applications of RFID already surround us. One of the most popular uses of RFID is the Mobil Speedpass payment system. Users are given a keychain fob with an embedded RFID tag that is programmed with a unique ID number. That number—which is meaningless to anyone else—is associated with the user’s payment information in Mobil’s database, including a credit card number. To make an effortless payment, the user only has to wave the fob in front of an RFID reader at the gas pump or the register.
Similarly, several public transit systems have begun issuing payment cards embedded with RFID. Using kiosks or direct deposit, commuters periodically add funds to their account, which is in turn associated with the unique number in the RFID card. Subway turnstiles are equipped with RFID readers, and waving your card in front of them lets you in and deducts the appropriate fare from your account.
Delta Air Lines is leading the way to track passenger bags using RFID. Current tracking systems rely on barcodes affixed to bags with adhesive labels, but these need to be manually scanned. Delta is testing a system that would embed RFID tags in the printed labels to allow baggage tracking using RFID readers placed at strategic points, including luggage carousels. Today, if a passenger bag is misdirected, airlines struggle to identify the specific lost bag, which might have been sent anywhere in the country. By using RFID, Delta hopes to be able to pinpoint a bag’s location and automatically send a wireless message to a staff person in a position to pull the bag and send it to its proper destination.
There are a plethora of commercial uses of RFID being developed and already on the market. But the one application that has captured the imagination of corporate America—as well as that of privacy activists—is effectively replacing barcodes on consumer goods by tagging every retail product with a uniquely numbered RFID chip.
The goal is to streamline the entire supply chain—from manufacturing to distribution to retailer. Constant, automatic knowledge of inventory levels means reduced warehousing costs and inching ever closer to that state of nirvana known as just-in-time manufacturing. Suppliers could save money by keeping better track of their returnable assets like pallets and containers. The technology also promises to help manufacturers and retailers prevent “backshop” theft, which is estimated to cost companies billions of dollars each year. Identifying whole shipments of goods automatically upon arrival at a loading dock could save labor all around. As one observer put it, “Wal-Mart would love to be able to point an RFID reader at any of the 1 billion sealed boxes of widgets it receives every year and instantly know exactly how many widgets it has. No unpacking, no unnecessary handling, no barcode scanners are required.”
Retailers also expect RFID to result in greater customer satisfaction. “Smart shelves” that keep track of how stocked they are—and that send automatic messages to the storeroom when their level of, say, Tickle Me Elmo dolls gets too low—will ensure that customers always find shelves full. If this information is shared with suppliers, they could be better able to match supply to demand and reduce inventory sellouts. Also, consumer products that are tagged with unique identifying numbers at the item level could enable returns without a receipt, as well as the much-touted self-checkout. Unique identification could also reduce waste during product recalls by pinpointing the few defective items rather than sacrificing a whole batch.
But in order to make these cross-industry benefits possible, the codes that will identify products in the supply chain must be standardized, just like UPC codes are today. That standard, known as the Electronic Product Code (EPC), is being developed by a coalition of industry heavyweights, and some predict it will in fact replace the UPC.
EPCs are essentially the wireless version of the UPCs found on barcodes, but with one important exception: EPCs can identify products uniquely at the item level.
The EPC is a virtual unique license plate for a product that identifies the manufacturer (e.g. Gillette), product class (e.g. Mach 3 Razor), and serial number (e.g. the 574,896th instance of the Mach 3 Razor). Using this EPC, members of the supply chain can thus identify and locate information about the manufacturer, product class, and instance of a particular product. Depending on the type of tag, EPCs can be used to uniquely identify up to 268 million unique manufacturers, each with 16 million types of products. Each unique product can include up to 68 billion individual items, meaning the format can be used to identify hundreds of trillions of unique items.
This range is made possible by the storage capacity available on RFID chips. While UPC barcodes can only store 7 bits of information, EPC RFID tags can store up to 256 bits.
EPCglobal is the standards-setting body that controls the EPC standard. It also controls the network that will make the sharing of EPC information possible. This network includes a naming service, which assigns EPC numbers to manufacturers, as well as a repository of manufacturer-assigned EPC data. The goal of the network is to have complete real-time supply chain visibility, so that manufacturers, retailers, and middlemen have better control over the distribution channels they manage. VeriSign, operator of the World Wide Web top level domains “.com” and “.net,” was chosen by EPCglobal to provide the root name system for the EPC Network, which will be based on the Internet’s Domain Name System.
Government has also recognized the potential of RFID. Underscoring the notion that the technology’s core application is inventory control, the most important government use of RFID to date is asset management by the Pentagon. The military has spent about $100 million over the last decade implementing RFID technology to track everything from rations to uniforms to tanks. The goal is to prevent frontline troops from suffering supply shortages, as well as reducing the amount of lost, misplaced, and unused supplies. Unlike industry, the military has so far focused on active RFID tags—with a price tag of about $100 each—to track vehicles, cargo containers, and other large and valuable assets from long distances. However, it plans to increase its use of passive tags soon.
Other government uses are more theoretical. In a recent report, the FDA endorsed RFID tags as a means to reduce drug counterfeiting, and urged pharmaceutical companies to adopt the technology. Because an RFID network could trace the path a drug takes from its manufacture to its disbursement, it could help verify its authenticity. Meanwhile, the International Civil Aviation Organization (ICAO), the international body responsible for passport standards, recently endorsed the use of RFID on passports. This move has conjured the specter of RFID-equipped driver’s licenses or national ID cards. Another rumored government use is placing RFID in currency. According to press reports, the European Central Bank is experimenting with RFID chips in euro notes.
Although the UPC standard for barcodes was set in 1973, its use did not catch on until about a decade later. While only 15,000 suppliers were using barcodes in 1984, in three short years that number skyrocketed to 75,000. What happened in 1984?
Wal-Mart’s UPC mandate is what happened. Striving as ever to improve its warehousing and distribution, the retail behemoth mandated that any supplier who wanted its business had to use the new barcode on its products. Manufacturers, dependent on the business of the world’s largest retailer, obeyed, and today the UPC is ubiquitous. It should be no surprise then that when Wal-Mart announced in mid-2003 that it expected its top 100 suppliers to begin using RFID by January 1, 2005, it effectively launched the RFID revolution.
Not to be outdone, the Department of Defense announced its own RFID mandate, also with a deadline of January 1, 2005. That mandate requires that all of the Pentagon’s 46,000 suppliers embed passive RFID chips in each individual product if possible, or otherwise at the level of cases or pallets. While Wal-Mart’s eventual goal may be item-level tagging, its initial mandate is only on the case and pallet level.
Despite the promise of RFID, many activists have been vocally concerned about the privacy implications of the technology. The ability to track objects is the ability to track persons, they say. In this section, we will see why such fears are overstated. We will also see why the truly worrisome potential uses of RFID are by government, and not by industry where the activists have focused their attention.
In November 2003, a coalition of thirty-five organizations, including the ACLU, EFF, and EPIC, released a position paper on RFID (“Joint Statement”). That statement has become one of the most cited articulations of RFID critics’ concerns. Specifically, the statement addresses five aspects of the technology that the authors feel could threaten individual privacy.
First, given how tiny RFID tags can potentially be, the ability to hide them in objects and documents without the knowledge of persons later obtaining those items concerns the statement’s authors. Second, and related to the first concern, is the ability to hide RFID readers. Third, RFID allows unique numbering of individual items. Fourth, they note that deployment of RFID (as currently envisioned by EPCglobal) “requires the creation of massive databases containing unique tag data.” They are concerned that such a database could be combined with personally identifying data, essentially linking people to objects. Last, they are concerned that persons may be tracked or profiled without their consent. As an example, they posit a person who has been associated with a shoe being identified by the EPC on that shoe when she attends a political rally. These concerns are echoed in the writings of other critics.
Other less-realistic concerns include the fear that technologically perceptive burglars could case homes by covertly cataloging their contents from the street. More ominously, some critics say “RFID systems could also pose a fatal threat if stalkers manage to adapt the technology to monitor a victim’s belongings, embedded with RFID microchips, and track their whereabouts.” Perhaps scarier still to some is the possibility that RFID technology could be used for targeted marketing:
[The potential pervasiveness of tagged products] raises the disquieting possibility of being tracked though our personal possessions. Imagine: The Gap links your sweater’s RFID tag with the credit card you used to buy it and recognizes you by name when you return. Grocery stores flash ads on wall-sized screens based on your spending patterns, just like in “Minority Report.”
Putting aside for the moment the fact that ubiquitous product tagging and pervasive readers, as well as the object databases implicit in the just-mentioned scenarios, are many years away, if indeed they ever materialize, these “disquieting possibilities” may still not be as worrisome as they seem.
One reason why some privacy activist’s concerns are unfounded is that today, retailers already track people’s purchases to better market to them. The most obvious example is Amazon.com, which welcomes you by name when you visit their Web site, and makes eerily acute recommendations based on your past purchases. In the physical world, supermarkets and other retailers issue customer loyalty cards that help them track consumer spending patterns in order to better stock stores and price products. Checkout receipts now often include coupons targeted to the consumer based on her past purchases.
A “Minority Report” type scenario using RFID, in which a retailer identifies you based on the clothes you are wearing and markets to you by name, is unlikely to occur for two reasons. First, it is very creepy. Such tactics are more likely to alienate customers than impress them; retailers recognize this and will avoid the practice. Second, such a scheme would not be very practical. Identifying an object is not the same thing as identifying a person. A sweater might be bought as a gift, lent out, or sold secondhand on eBay. Retailers will not risk embarrassment by making assumptions about identity.
Similarly, while some worry that burglars will equip themselves with $500 RFID readers to “drive by a home and say, ‘Look what we’ve got in there. An HDTV is in there, and she wears Benetton,’” the fact is that burglars today already case homes by such low-tech means as looking through windows. Furthermore, the technical limitations of RFID might not make such casing very feasible. The range of RFID tags in the EPC standard is twenty to thirty feet at most. The Inverse Square Law of physics prescribes that the further one is from the tag, the more energy a reader will have to employ to read it. This makes long-range readers hardly portable or easily powered. Also, RF signals cannot pass through metal, liquids, and other dense materials, making long-range reading even more difficult. Finally, if you are still worried that a burglar will be able to read the contents of your home, you can install an RFID blocker device.
Many of the fears about RFID stem from a misunderstanding of the technology. One commentator fretted that “RFID systems would expose consumers to needless risk by allowing tech-savvy burglars to inventory a victim’s house from a distance,” and proceeded to cite to a news story about Wi-Fi wardriving. RFID is not Wi-Fi (nor is it GPS as we will see below). Another commentator seemed to grasp the limitations, but nevertheless cast the threat like so: “Future burglars could canvass alleys with RFID detectors, looking for RFID tags on discarded packaging that indicates expensive electronic gear is nearby.” But burglars today do not need RFID readers to spot the plasma screen TV crate on your curbside.
Even if criminals or overzealous marketers could put the technology to use for nefarious purposes, it should not be proscribed, as some would have it. Doing so would be like limiting telephone technology because ransom demands or telemarketing messages could be communicated across the wires. Criminal activity is unlawful, whether it involves RFID technology or not. How retailers and marketers may use information they collect about consumer habits is a debate that existed before RFID, and that debate is independent of the technology employed by marketers. The fact that a debate exists should no more affect the adoption of RFID technology than it should ban Web cookies or existing loyalty programs.
These daft concerns overstate the threat of RFID because they do not take into account the limitations of the technology or the self-interest of retailers. It is the more legitimate concerns of privacy activists, embodied in the Joint Statement, which should be more carefully addressed.
The five points of the Joint Statement can be summed up this way: RFID will allow individual persons to be tracked (1) at all times, (2) without their knowledge or consent. These are serious concerns. But, as we will see, there is less cause for alarm than such a statement might seem to suggest.
The idea that one can be tracked anywhere and at any time conjures up the image, often seen in the movies, of a blip on a screen representing a person and her every move. Her pursuer, privy to this information, need only overtake her at the next corner. No wonder some are concerned about stalkers using RFID against their victims to “track their whereabouts.” But this concern seems to conflate RFID with GPS, or simply with the idea that the location of a “bugged” person can be pinpointed at will.
GPS can be used to locate a lost hiker or a stolen car because a GPS device can not only use the information from satellites orbiting the earth to locate its exact position, but might also contain a high-powered radio transmitter (not unlike that of a cell phone) that broadcasts its location. But tiny RFID tags cannot read satellite signals, nor do they transmit strong radio signals, especially without a prompt from a reader. A better analogy for how RFID tags help “track” an item is the way a barcode helps FedEx “track” a package.
The process of sending a letter via FedEx begins when you seal and address the letter and take it to your nearest drop-off point. The FedEx label you affixed to the package has a unique identification number and a corresponding barcode—for your records, you keep a copy of that number. A FedEx employee scans the barcode and enters the destination of the letter into the computer. The unique number is associated with your letter’s destination in FedEx’s database.
The employee places the letter in the appropriate bin or conveyor belt and off it goes on its journey. When the letter leaves the building, its barcode is scanned, and a notation is made in the database: “Left Washington, DC on 4/15/04 at 5:39 p.m.” When it gets to the airport it is scanned again and another notation is made: “Arrived Dulles Airport on 4/15/04 at 7:45 p.m.” The letter is scanned each step of the way: on the plane, at the other airport, at the sorting facility, on the truck, and finally with a hand-held scanner when its delivery is confirmed.
At any time after drop-off you can log on to FedEx’s Web site, enter the letter’s unique number, and see the location where it was last scanned. In this sense you can “track” your package, but this does not mean you know where it is at any given moment. The database might say, “On the plane to Bangkok,” but your package might well be on the ocean floor. Your information is only as good as the last place where the letter’s RFID tag was read. In this same way, RFID tags will allow manufacturers, distributors, and retailers to track items throughout the supply chain, but it will not let them know where an item is at any given moment.
To track you in any meaningful way, a stalker would have to have access to the databases of the retailers from which you have purchased RFID-tagged items (that you may or may not have in your possession at the moment) in order to know which EPC numbers correspond to you. (And this, of course, assumes that retailers will link personally identifying information to EPC numbers and keep this information in a database.) Once she has those numbers, the stalker will need to have a network of RFID readers throughout the geographic area she wishes to search. Even then, your stalker will only know that an item linked to your name was scanned at a certain place at a certain time. If you have lent or sold or even thrown away any of your items, she might find that you are in five different places at once. There are better ways for stalkers to follow persons; EPC tags will not put anyone’s life at risk.
Nor is RFID practical to discover which persons attended a political rally, as the Joint Statement authors and others fear. First, assuming that there is a database linking you to every RFID-tagged consumer product you have ever purchased at any and all retailers, the presence of an item linked to you at a political rally may well still be a false positive, as explained above. Second, how would the persons interested scan the crowd at a rally? Given the read-ranges of RFID tags, they would either have to make sure everyone passed through a reader-equipped gate of some sort, or they would have to inconspicuously get near enough to each person to scan them. They would also have to contend with reader detectors and jammers.
It would therefore seem that a more traditional means of discovering who attends a rally, such as photo or video surveillance, would be more efficient. This, again, raises the issue of hating the game, not the player. That is, there exists an ongoing debate over the propriety of public surveillance, but that debate is independent of the technology employed. The fact that an unresolved debate exists, and that RFID might possibly be used for surveillance, should not limit the technology’s adoption in areas where there is no doubt it will be appropriate and useful. More to the point, what motivation would retailers have to identify persons at a political rally? To target-market “Future Dem” baby bibs? More likely, who we fear will use this technology to keep an eye on rallies is the government, much as it has done for years. But if this is the case, it simply means that there is another game to hate, whoever the player, as we will see in Section II.C below.
Related to the fear that one will be tracked anywhere, critics are concerned that RFID will be used to track individuals in their own homes. This brings us to the second aspect of the Joint Statement’s concern, that persons will be tracked without their knowledge or consent. In particular, critics fear that retailers will use credit card numbers to link individuals to their purchases. But it is interesting to note that while this is feasible today, consumers continue to opt for loyalty programs. There are good reasons for this.
Consumers would likely not look kindly on anyone but their credit card company keeping a list of their credit card numbers without their permission. Retailers are happy to avoid the market backlash that doing so might bring. They are also happy to avoid the potential liability that might result if only a few of the collected credit card numbers are mishandled. Today, any sensible merchant knows not to keep on file the credit card information of its customers because nothing good can come from doing so. Additionally, credit card companies do not want their customers’ credit card numbers stored or used as identifiers by retailers and will make this part of merchant agreements as they do today.
This de facto privacy protection policy further underscores the fact that the theoretical privacy debate should be separated from the technology. Whether retailers should be able to use your credit card information in combination with a database to track purchases is a question that has nothing to do with item-level tagging of consumer goods using RFID.
Joining a loyalty program is a choice consumers make. If retailers do not abide by their program’s agreement, they are liable for breach. Similarly, retailers value the business of customers who choose not to participate and will not want to invite their ire by tracking them nonetheless. Companies have begun to publish EPC privacy statements to which they will also be held accountable. These statements include promises to clearly label the use of RFID tags and make them easily removable. Regulation of RFID is unnecessary unless we find that market forces have failed to constrain practices that make us uncomfortable. In fact, regulation may be unnecessary altogether because RFID may never be ready for primetime.
The promise of RFID might be as over hyped by its proponents as its threats are by its critics. As one technologist put it, “People are a bit focused on its usage potential as opposed to how to make it really happen.”
In fact, the push for general adoption of RFID seen today would have likely never happened but for the Wal-Mart mandate. And although Wal-Mart’s stamp of legitimacy does give the technology a big boost, it does not mean that it will work. Wal-Mart is not infallible, and if RFID does not work out, the retail giant will have no qualms about dropping the venture.
We now know that the overwhelming majority of Wal-Mart’s top suppliers will not be able to meet the January 2005 deadline for adopting RFID. Only about 25 percent of suppliers will likely meet the goal—a precipitous drop from a previous estimate of 60 percent. Complying with Wal-Mart’s guidelines will cost a typical supplier about $9 million, and up to $100 million in some cases. These outlays come with no immediately apparent return on investment, and most suppliers can only hope to minimize losses from complying with the mandate.
If RFID is ultimately adopted, it will not be for a long while. The cost of tags needs to drop significantly before they can be deployed profitably on product lines. Item-level tagging will not be prevalent until RFID tags cost at most five cents each, and this puts such tagging at least seven years away. Adding to the cost of deploying RFID is the fact that there are very few, if any, consultants with a track record of successful implementations. Hiring expertise is very expensive. There is also little motivation to adopt RFID immediately since UPC barcodes work fine today. Given that there is a vast installed base of legacy barcode systems, there will likely be “considerable inertia” in adopting RFID.
Wal-Mart might also be the exception, not the rule. Wholesale distributors have very little incentive to adopt RFID:
Distributors purchase products from manufacturers at bulk discounts. They assume the market risk, reselling the goods for a profit to retailers. With radio identification, it’s possible that these middlemen could be cut out of the process. Manufacturer and retailers would know the balance of supply and demand in real-time and, as a result, could choose to deal directly with each other.
Additionally, the benefits of the EPC Network assume a vast sharing of information among participants in a supply chain to increase visibility. This presumes an unprecedented level of cooperation, and disregards the market for information. “Knowledge is power—if retailers readily disgorge information of interest to manufacturers, they may weaken their negotiating position vis-à-vis their suppliers,” one observer has noted. “And, to the degree that retailers are able to interrogate RFID-bearing items on their shelves, other parties, to include competitors, may be able to do so as well.”
If the business disincentives to adoption do not convince you that RFID’s prospects are not as rosy as some would suggest, there are always the technology’s technical limitations. As mentioned above, the signals emitted by RFID tags cannot penetrate metal, liquids, and other dense materials. Even things like cold storage, humidity, and microwaveable containers hurt reliability.
Barcodes are 99 percent accurate. Without at least the same reliability, RFID is all but useless. Field tests carried out by the Auto-ID Center to simulate real-world distribution scenarios returned disappointing results. Only 78 percent of tags were read during the four-month trial. While a relatively friendly environment like a distribution center could be engineered to minimize interference, a retail store floor with RFID tags scattered throughout is a comparatively hostile setting. Self-service checkout also requires near 100 percent reliability, and so “is likely to be a pipedream.” Even Wal-Mart acknowledges that such a check-out system is at least ten to fifteen years away.
Finally, while barcodes are easily standardized across the world, RFID standardization is more difficult because it is dependent on the radio spectrum, which is regulated differently by each country’s government. It therefore seems that RFID-tagging of consumer products is confronted with more obstacles than either its critics or proponents care to admit.
The nightmare scenario of RFID critics is the tracking of persons—either at a political rally, by a stalker, or by a retailer who wants to engage in targeted marketing. But as we saw above, the use of EPC numbers to track individuals is impractical, if not impossible. For one thing, EPC numbers would only correspond to items, and associating a person to an item would mean hazarding a guess at best. However, one scenario eliminates the guesswork: government assigning a unique number to each individual.
One critic, contemplating the various possibilities of a surveillance state, posited the following scenario:
A tourist walking through an unfamiliar city happens upon a sex shop. She stops to gaze at several curious items in the store’s window before moving along. Unbeknownst to her, the store has set up the newly available “Customer Identification System,” which detects a signal being emitted by a computer chip in her driver’s license and records her identity and the date, time, and duration of her brief look inside the window. A week later, she gets a solicitation in the mail mentioning her “visit” and embarrassing her in front of her family.
But notice that without a government-mandated chip, which identifies the woman uniquely, this scenario could not take place so easily. Attempting to guess her identity by reading EPC numbers on her clothes, for example, might prove difficult. It would require access to the EPC Network, which a sex shop may not be as likely to have, and it ultimately would only be a guess. But a government ID number identifies the person, not an item. A database that correlates government ID numbers, names, and other personally identifying information could be reverse-engineered, much like the Internet Movie Database was developed without the help of industry. The less reputable a retailer is, the more likely they will engage in such “creepy” direct marketing. Similarly, a government ID would pose a much greater threat to anonymity than a consumer product that has been tagged with an EPC number, and this would make a stalker’s task a bit easier.
If one is truly concerned about government tracking of individuals at political rallies or anywhere else, then a national ID, especially one equipped with RFID or other Auto-ID technology, should be the focus of one’s attention. The involuntary nature of a government mandate makes it particularly dangerous. The recent Hiibel v. Sixth Judicial District Court of Nevada, Humboldt County decision found that citizens could not refuse to identify themselves when agents of the state demand it. It may only be a matter of time before government facilitates compulsory identification by mandating a national ID card embedded with RFID chips.
National ID card legislation has been proposed and seriously considered after the terrorist attacks of September 11, 2001. Last year, delegates to the Chinese Communist Party Congress were required to wear an RFID badge at all times so that their movements could be tracked and recorded. Today, passports may soon be equipped with RFID tags, and the Department of Homeland Security is currently developing RFID-enabled IDs to be used at border crossings. The growing campaign by government to require its citizens to identify themselves, regardless of the technology employed, is the greatest threat to anonymity. Yet, critics of RFID continue to focus on private uses of the technology, and mention threats from government only in passing.
In March 2004, Senator Patrick Leahy (D-VT.) became the most prominent politician to address the privacy concerns over RFID. He did so with a speech before a privacy and security conference at Georgetown University Law Center. Calling RFID tags “barcodes on steroids,” he said that while there may be many business advantages to using them, “RFIDs seem poised to become the catalyst that will launch the age of micro-monitoring.”
“[T]he RFID train is beginning to leave the station,” he warned, “and now is the right time to begin a national discussion about where, if at all, any lines will be drawn to protect privacy rights.” Leahy called for congressional hearings before the “RFID genie is let fully out of its bottle.” Such a dialogue, if truly open-minded, can indeed be very helpful in educating everyone involved about the possibilities and limits of RFID, as well as about the legitimate concerns of the privacy sensitive public.
The Joint Statement similarly calls for such a debate. It asks industry to impose a voluntary moratorium on item-level tagging until a “formal technology assessment” sponsored by a “neutral entity” is completed. However, there are some points the Joint Statement deems non-negotiable, and it lists several “RFID practices that should be flatly prohibited.” The Federal Trade Commission recently took a first step toward a national dialogue by hosting a one-day conference on RFID at which all sides of the debate gathered to participate.
But despite calls for reasoned reflection, and despite how much time there is before RFID is ever seriously implemented, some still wish to nip this technology in the bud. They refuse to separate the technology from the larger privacy debate, and they will not wait to see if market and cultural forces can acceptably shape RFID practices on their own. Katherine Albrecht, head of Consumers Against Supermarket Privacy Invasion and Numbering (CASPIAN), the group that has taken the lead opposing RFID, stated it succinctly when she said, “I think the main way we’re going to prevent RFID abuse is to limit its implementation.” Boycotts and protests by CASPIAN have caused Italian clothier Benetton and German supermarket chain Metro to forsake RFID tests. Sadly, the restless desire to forgo a national dialogue, and deal a blow to RFID today, is shared by lawmakers in several states.
Legislators in California, Utah, and Missouri have introduced bills to regulate RFID, and at least one legislator in Massachusetts says he will follow suit. While the Missouri bill would only require retailers who sell RFID-tagged products to label this fact conspicuously, the California and Utah bills go further. The Utah bill not only requires notice to consumers about the presence of RFID, it requires manufacturers and distributors to alert retailers of the presence of tags and teach them how to kill the tags if possible. It also provides a private right of action to enforce the provisions of the bill. The Utah bill is based on a federal “RFID Right to Know Act” proposed by CASPIAN, which would amend several portions of the U.S. Code.
The California bill, though heavily amended from its original version, is the most far-reaching. It prohibits item-level tagging that “enables the user” to collect information from tags that “could be used to” identify individuals unless certain conditions are met. Among the conditions are the following restrictions: (1) Collected information must be provided by the “customer for the purpose of completing a transaction to purchase or rent an item containing an RFID tag at a retail store,” and (2) “the information [must not be] collected at any time before a customer actually initiates a transaction to purchase or rent an item or at any time after the customer completes the transaction.” There is no provision in the bill allowing customers to voluntarily opt-in and consent to use of their information beyond what is provided for in the bill. The bill also specifically places similar restrictions on lending libraries.
Under such a law, it is not clear that an application of RFID similar to the one by Prada in New York would be permissible. The California bill does not seem to allow voluntary use of RFID-enabled loyalty cards that could help retailers give specialized attention to their customers. Even if such a loyalty program were permitted, the California bill only allows the use of RFID “for the purpose of completing” a sale, and restricts the technology’s use until “a customer actually initiates a transaction to purchase.” This would seem to eliminate the possibility that a customer could take advantage of RFID to shop without actually purchasing. For example, an RFID-enabled store in Germany uses the technology to let customers know where the items they are looking for are located in the store. Additionally, the bill’s restriction on collecting information “at any time after the customer completes the transaction” would seem to preclude post-purchase conveniences like receiptless returns.
It is interesting to note that this is an amended version of the bill. The original proposal would have required written consent before any individually identifiable information about a person was attached to data collected via an RFID system, or shared with a third party. The original bill also required retail stores to detach or destroy RFID tags on consumer products before they left the premises. Other critics have proposed this popular solution as well. But as some have noted, not only would this requirement preclude post-purchase applications of RFID, it also amounts to an unfunded mandate. Not all retailers are Wal-Mart; most are small “mom and pop” stores that will lack the ability to detect, much less kill, RFID tags. Requiring all retailers to kill tags embedded by manufacturers in consumer products creates great pressure against use of the tags. Perhaps most interesting to note is that the original version of the California bill placed its restrictions on “persons or entities.” The amended bill carefully replaces that phrase with “private entities” and “libraries,” thereby leaving government agencies free to use RFID as they please.
If the technical limitations and cost of RFID do not prevent its deployment, restrictive legislation just might. Critics and legislators are jumping to conclusions and hating the player instead of the game. Simply because a technology could be used in harmful ways does not mean that it will. One needs to look no further than the failure of RFID at Prada’s New York store, the impending failure of manufacturers to meet Wal-Mart’s mandate, or the RFID policy changes announced by Benetton and Metro to see that market forces constrain businesses. We should not regulate new technologies until we know how they will play out in the market. To do otherwise is to risk killing useful and wealth-creating technologies before they have had a chance to become viable. We would forgo all the unexpected and creative applications that are spawned once a technology is widely adopted—the Internet, for example, was never meant to be an auction house or a dating service.
It is already becoming apparent how retailers and other companies plan to address the privacy concerns of consumers. (After all, we should not forget that consumers are the persons on whom retailers depend for their continued existence and prosperity.) A recent survey by market analysis firm Forrester Research found that 21 percent of U.S. consumers who are aware of RFID tags fear the prospect of companies tracking their purchases. Forrester suggested that retailers develop an RFID code of conduct to help align their business plans with consumer sentiments. They also suggested that because many consumers would appreciate that tags be killed before they left the store, that retailers consider this as an option. Not surprisingly, industry has taken the hint.
EPCglobal has released a set of guidelines for EPC on consumer products. These include giving clear notice of the presence of RFID on products, as well as the ability to disable or discard RFID tags. Procter & Gamble, one of the largest early adopters of RFID technology, has adopted very similar privacy guidelines. Regulation, and all its attendant costs, is unnecessary unless market forces fail to meet consumer preferences on privacy.
Furthermore, existing laws already protect consumer privacy regardless of the technology employed to invade it. For example, California, like most jurisdictions, recognizes the privacy torts first proposed by Warren and Brandeis and later articulated by Prosser. These four privacy torts are recognized in the Second Restatement of Torts.
The type of surreptitious tracking RFID might facilitate would be covered by the tort for unreasonable intrusion upon the seclusion of another. For liability to exist under this tort, there must be an “intentional intru[sion] . . . upon the solitude or seclusion of another,” and the intrusion must be of a kind that is “highly offensive to a reasonable person.” This tort generally does not apply when the individual is in the public eye. Yet, this is not a hard and fast rule. Solitude does not depend on the victim’s location, but rather on the victim’s expectation of privacy and the kind of invasion that took place.
California’s constitution also recognizes a right to privacy. The provision is self-executing and confers an individual right of action. In White v. Davis, the California Supreme Court found that the main purpose of the constitutional grant of privacy is to tackle “the accelerating encroachment on personal freedom and security caused by increased surveillance and data collection activity in contemporary society.” Specifically, the Court cited legislative history explaining that the constitutional amendment was meant to address concerns such as the “[c]omputerization of records [that] makes it possible to create ‘cradle-to-grave’ profiles of every American,” as well as the race to compile ever more “extensive sets of dossiers of American citizens.” Not only does the constitutional right protect against government intrusion, but it extends to business misuse of information as well.
Among the Joint Statement’s list of RFID practices that should be “flatly prohibited” is, “merchants must be prohibited from forcing or coercing customers into accepting. . . RFID tags in the products they buy.” But forcing or coercing persons into doing anything against their will is already tortious conduct. However, a series of proposed RFID guidelines recently issued by EPIC sheds more light on how many privacy advocates define “force.” That document states that merchants shall not “[c]oerce individuals to keep tags turned on after purchase for such benefits as warrantee tracking, loss recovery, or compliance with smart appliances.”
The law usually recognizes the requirement of action X in exchange for service Y not as coercion, but as a trade. What regulations such as the proposed EPIC guidelines seek is not privacy protection, but an entitlement or a wealth transfer. They want privacy-sensitive consumers to receive the good (loss recovery, smart appliance compatibility) without having to pay the attendant cost in privacy. The effect of such a rule is to negate the lower prices made possible by technology such as RFID.
RFID-specific laws to protect consumer privacy from businesses are unnecessary because existing contract, tort, and statutory privacy laws work. To single out RFID for special treatment might well be to kill it. Given the technology’s precarious position today, removing any incentive for its adoption might spell its doom.
As we have seen, the main RFID threat from government is the imposition of a mandatory national identifier. Such a mandate, while potentially unwise, is likely not unconstitutional. Any check against such a system will have to be political. In the meantime, existing legal checks will restrain government surveillance using RFID where there is an expectation of privacy. Existing statutory privacy provisions, like the California Constitution, include protection from government snooping. More importantly, Fourth Amendment law also curbs government high-tech surveillance powers.
In Kyllo v. United States, the Supreme Court held that the use without a warrant of a thermal imaging device to scan the level of heat emanating from within a home constituted an unreasonable search under the Fourth Amendment. The Court held that a search occurs when sense-enhancing technology obtains information “that could not otherwise have been obtained without physical ‘intrusion into a constitutionally protected area,’” and the technology used “is not in general public use.” In contrast, the Court in United States v. Knotts, found radio frequency tracking not to be a violation of the Fourth Amendment. In that case, police placed a “beeper”—effectively a radio transmitter—on a container of chemicals that the defendant purchased. The police used the beeper’s signal to track the defendant to his cabin, where police found a drug lab. The Eight Circuit Court of Appeals found use of the beeper to be an unreasonable search under the Fourth Amendment, and reversed the defendant’s conviction. But relying on Katz v. United States, the Supreme Court reversed the appeals court, holding that there is no reasonable expectation of privacy when traveling in an automobile on public roads.
The rule therefore seems to be that radio frequency tracking is allowed without a warrant, unless it impinges on a constitutionally protected space—chief among them the home. Reinforcing this analysis is United States v. Karo, which also involved police placing a beeper on a container of chemicals to track a defendant’s movements. While again holding that the police’s covert placement of a beeper on a container was not a search, the Court recognized Fourth Amendment protection when the beeper moved out of a public place and into a private space.
RFID holds great potential to revolutionize not just the logistics business, but many other industries as well. Successful implementation would mean increased convenience and lower prices for consumers. But this will only happen if technological hurdles can be overcome, and if a business case can in fact be made for widespread use of RFID.
Although new technologies commonly elicit exaggerated privacy concerns, informed concerns should be taken seriously. However, until those fears are proven sound, legislators and regulators should resist constraining the use of RFID technology. Otherwise, they risk distorting or aborting what could be a very beneficial development. Existing law and, more importantly, consumer attitudes and the market forces they spawn will restrain undesirable use of RFID.
