Maxwell points out that we can divide our thinking about EPCs into three areas. First, is the use of EPCs at the pallet level to manage the flow of products through the supply chain. These RFIDs that are discarded at the back end of the store pose far fewer privacy concerns than other uses of RFID technology. Second, there is the use of RFIDs up to the point of sale that poses a set of privacy concerns comparable to customer loyalty card concerns and customer surveillance issues. Then the most troubling set of issues are those beyond the point of sale, where a consumer leaves the store and still has functional RFID tags on her products "in the wild."
Beth Givens of the Privacy Rights Clearinghouse showed slides (available here soon) that educated attendees on both what industry says are the benefits of RFIDs and what privacy concerns she has about RFIDs. The benefits hoped for paint a picture of a utopian world with lots of consumer convenience: Your car's tires could have RFIDs that communicate with the dash to let you know when tire pressure gets too low, products containing toxic substances can have RFIDs that are scanned prior to going into a landfill and then set aside for proper disposal, consumers can stop worrying about saving receipts as the RFID tag on their product can automatically tell the store whether a return is authorized, etc.
But, Givens points out several privacy concerns RFID tags pose when they end up on individual products.
Jackie Griffin of the Berkeley Public Library explained their motivation for and approach to RFID tags on their books. First, she gave a sincere and convincing introduction to her committment to privacy issues and serving library patrons well. I don't say that lightly. It was clear that Griffin is someone that cares deeply about libraries, their patrons, and the privacy of those patrons. But as you might guess, she ended up on the defensive when privacy activists learned that the Berkeley Public Library was going to tag the books.
Griffin explained their motivation. First, the funding of libraries is under particular strain. Everyone is having to make do with less money, the library is no exception and their cuts are deep. Second, aggravating this issue is their astronomical worker's compensation expenses. If I heard correctly, just last year they had 17 repetitive-stress injuries. The injuries caused by a librarian's daily work can be permanently disabling and often result in the retirement of an otherwise able librarian. They needed a technological solution, and RFIDs offered one.
Griffin made clear that they worked closely with RFID vendors to get tags that contain only the barcode information and not a tag containing a zillion other privacy-concern-raising bits of data. They were willing to work closely with those concerned to establish "best practices" to try to implement this system in a way that maximizes patron privacy.
Unfortunately, in the short time Griffin had, she didn't win this attendee over and I don't think she assuaged the fears of many others. We didn't get to this issue, and I know little about the problems she faced, but I wonder why a collaborative technological solution couldn't work as well or better than RFID. At both the UC Irvine and UC Riverside libraries I have used "self-checkout" systems that seem to me like a great way to distribute the stress of book-handling during the check-out process, so that no one librarian suffers from repetitive stress. Sure, you have to train patrons on the system, and some will be reluctant to adopt it, but it works with the barcode system already in place (low-cost) and with enough encouragement (or through lack-of-choice), I believe it could be widely adopted by patrons, especially if they learn that their alternative is a technology that poses such extensive privacy problems. I'd be pleased to hear from those more knowledgeable why this alternative isn't viable.
Ann Brick, staff attorney with the ACLU of Northern California, explained how the use of RFID by the government poses particularly troubling concerns. The government is a huge consumer of all kinds of items. The Dept. of Defense recently required all its suppliers (over 40,000!) to implement passive tags on the case and pallet level. (I have to mention a worrisome example from a talk Ross Stapleton-Gray gave at SIMS recently. If RFID tags go down to the individual item level on D.O.D. purchases, the high chance that some unique RFID tag will accurately identify military officers creates the following problem: A roadside bomber in Iraq sets up an RFID reader on the road, waits for the tag to go by that identifies a sufficiently high-ranked officer, and then he detonates the bomb. Ouch. Hopefully the government has given this enough thought that they'll avoid such problems.) Brick also talked about the government's use of RFID. There are various ways tags could be implemented by the Transportation Safety Authority (TSA) in airports on baggage or boarding passes, raising various concerns, and proposals about implementing RFID chips in passports pretty much sent the attendees over the edge.
The technology is here and it works. It is coming to a Wal-Mart near you. And so, it is up to us to think carefully about the policy choices available to come up with a balance that allows for a potentially beneficial technology to work for us while simultaneously preserving our privacy rights.
]]>Richard Smith began the discussion with an explanation of RFID tags, explaining the basic functioning of the technology and providing a demonstration of the technology. Smith described many of the current uses of technology including keyless entry and tracking runners in the Boston Marathon. He also predicted for ubiquity of RFID tags, caliming that by 2010 the average person will carry at least ten tags on him at any given time.
The tutorial continued with a video, presented by Mary Hodder, displaying one of the practical applications of RFID. The video featured a discussion with a dairy farmer from California’s central valley who for the past five years has used RFID tags as a means of tracking information about his cattle including vaccination and pregnancy history. In addition, the tags could be used to easily track outbreaks of infectious diseases to particular herds.
Ross Stapleton-Gray raised a concern over the potential failure of retailers to deactivate tags after consumers purchase RFID-enabled products. These consumers, without knowledge of the presence or possible uses of the tags, would then be left vulnerable to harvesting of personal information by any RFID readers in their surroundings.
Governmental abuse of RFID technology was the issue of concern for EFF's Lee Tien. By mandating that its 43,000 suppliers make use of RFID tags, according to Tien, the Department of Defense is essentially subsidizing the technology. As use of RFID becomes “promiscuous, persistent, and pervasive” the threat to civil liberties increases.
Linda Ackerman of Privacy Activism discussed the threat posed by hidden placement of both tags and readers. Given the size of tags, they can be woven into clothing, integrated into paper, and printed onto packaging, making the consumer awareness of tags unlikely. The problem is exacerbated by the ability to integrate RFID readers into walls, floors, and sidewalks, making them difficult to detect.
Finally, Beth Givens provided some insight regarding the public policy challenge to RFID. A number of currently pending pieces of state legislation address the issue by calling limitations of the use of RFID technology or the clear labeling of products containing tags.
The RFID discussion will continue in Wednesday’s Concurrent 1.
]]>