Privacilla.Org

Home
Past Releases and Reports
Coverage
About Privacilla
Privacy Fundamentals
Privacy and Government
Privacy and Business
Online Privacy
Financial Privacy
Medical Privacy
Report your thoughts to Privacilla!
Your Source for Privacy Policy from a Free-market, Pro-technology Perspective


Click to return to list of releases and reports

Home > Past Releases and Reports > Remarks Entitled "Reality and Rhetoric in the Radio-Frequency Identification (RFID) Debate" to the American Legislative Exchange Councilís Commerce, Insurance, and Economic Development Task Force


Remarks of Jim Harper, Editor of Privacilla.org, Entitled "Reality and Rhetoric in the Radio-Frequency Identification (RFID) Debate" to the American Legislative Exchange Councilís Commerce, Insurance, and Economic Development Task Force

December 4, 2004

I am delighted to be here to speak with you about radio-frequency identification technology. I donít mind being here on a Saturday, though it means that I gave up a Friday night to be here. I know a lot of you are in the insurance area, and I donít know how RFID might impact insurance, but I hope for you my talk will be interesting, even if it's a little bit academic.

I am the Director of Information Policy Studies at The Cato Institute. Thereís no better title we could come up with than that for the issues that I cover, which is just about anything to do with the future, including technology, e-commerce, telecommunications, and so on.

I am also the editor of a Web site called Privacilla.org. (Thatís "privacy," drop the "y" and add Godzillaís tail.) Privacilla attempts to capture privacy as a public policy issue from top to bottom, including privacy from government and privacy from the private sector including online, medical, and financial privacy. Thereís also a section of the site on "Privacy Fundamentals." I think thatís one of the most important things because a lot of people talk about privacy without knowing what it is.

The word "privacy" is used to describe a great many important issues, but itís essential to know which one: it could be security, fairness, or any of a host of other issues. Too often, you legislators might see a bill that youíre told has to do with privacy. Itís hard to say "no" to a bill like that even if it does other things and has all kinds of unintended consequences.

To study privacy, I have to get some expertise in a lot of different areas, and one such area is RFID, or radio-frequency identification. RFID is a new version of an old technology: radio. Thanks to advances in manufacturing, they are now able to make radio transceivers and transponders that are quite small and handy.

RFID is not terribly new. It has been used for many years in logistics and aviation. An "active" RFID tag Ė that is, one with a battery in it Ė may be placed on a shipping container or in an airplane and it constantly signals what it is to a properly tuned RFID reader.

When President Reagan died, the importance of RFID has highlighted by an incident where Governor Ernie Fletcherís plane failed to signal what it was. The active RFID system in it went down so it was not giving the "friendly" signal to the local air traffic control. Apparently, there was some thought of shooting the plane down, and congressional offices were briefly evacuated. Luckily, they did not react too harshly and Kentucky still has a governor.

The new version of RFID is whatís called "passive" RFID. That is a tag that does not have a battery and so doesnít wear out or get old. It just sits there and relies on the energy given off by an RFID reader to respond with a code. It will give a serial number back to the reader which is then correlated with a database to tell you what the tag represents: what an item is, where it came from, where itís going, and so on.

Now, my topic is reality versus rhetoric, so let me go into some of the rhetoric on RFID chips. It actually starts with some of the people that manufacture RFID products. They have overstated quite remarkably what they can do with RFID.

The most exaggerated, I think, is the maker of RFID gambling chips. Theyíve said to casinos you can track every bet in the house using these chips. Well, itís just not true. Anyone who has played with gambling chips or watched one of those poker shows on TV knows that chips move around from player to player and from players to the house. Thereís just no way to track who has what chip or what theyíve done with them. Claims like these are just fantastical, but they lead to excessive worry about what will happen with RFID.

Now some advocates have picked up on these claims and accepted them at face value. They think that anything and everything can and will be done with RFID. The most extreme cases make it sound like an RFID chip in your shoe is going to broadcast where you are, thatís going to be picked up and transmitted by satellite to some central Big Brother database, and everyone is going to know where youíve been and what youíve been doing. Itís just not going to play out that way, for reasons Iíll discuss in a moment here.

Nonetheless, there have been a lot of calls for preemptive regulation of the potential of this technology. Hearings have been held at the state and federal levels, the Federal Trade Commission has done a workshop, legislation has been introduced to regulate RFID, and more is being considered. These are all based on the possibilities and not on any real-world experience.

But RFID will only come into use subject to a variety of limitations. One is physics: Itís hard to create a radio transmitter that will work in a wide variety of environments, particularly with low power. The experience with RFID shows that they are having trouble with liquids and metals, so a tag next to the human body or on a can of peaches might not register.

Wal-Mart is one of the big movers on RFID, and they have asked their suppliers to have RFID tags on pallets and cases, so that they can be read as a pallet comes into a warehouse or a case moves along a conveyor belt. But their suppliers are having trouble reaching even this relatively simple milestone. So RFID tags on individual consumer goods are still quite a ways off.

Letís understand what Wal-Mart is doing: Imagine moving your home or apartment 100 times in a day, and then being asked to put your hands on your nail clippers. Thatís the challenge for logistics people. Theyíve got to move huge quantities of goods and know where everything is at the same time. Probably millions of man-hours are spent each year going through warehouses to inventory them one box at a time.

Millions more dollars are lost to back room theft. A lot of people assume that theft goes out the front door of stores, but just as much goes out the back. If a carton shows up at a warehouse and itís not on the manifest, it might be in an employeeís car in no time. By keeping better track of items, this kind of theft and loss can be tamped down.

The greater efficiency and savings translate into dollars and cents saved to consumers. Retail is obviously a highly competitive area, and people are hurrying to implement RFID because they know that it will give them only a brief window of competitive advantage. After that, cost competition will drive prices down and send the benefits of RFID systems right out to consumers in savings on all the goods they buy. But let me get back to how RFID will be controlled.

Economics and cost will probably be the most important limitation on RFID. Readers today cost upwards of a thousand dollars. This means that people who operate RFID systems are not going to put readers all over the place Ė in the parking lot or down the street at the 7/11. Theyíre going to put readers where they can get data that is useful for serving the consumer and improving the product.

And keeping data costs money. I was at an event recently where a guy who works with Department of Defense Ė another big RFID user Ė said that their first job is to throw away data. They get rid of about 70% of the data they collect because it doesnít tell them anything they want to know. If they kept all this data, it would cost an incredible amount.

I have also visited data storage facilities where they collect consumer data, and Iíve asked the people there Ė not government relations people but the people who run the storage Ė how they do things. They constantly throw away data because itís so costly to maintain if they do not need it. And they are careful to incinerate old data so it can never be recovered.

The data center I went to cost a quarter of a billion dollars to build, so they know the price of storing data in big quantities. Itís big dollars. Big warehouses of RFID-created data wonít happen. It will be just as important to get rid of the data.

The tags cost money too. Right now, theyíre at about twenty cents, and they might get down to around five cents when theyíre fabricated in large enough quantities. But that means that theyíre never going to be on pieces of candy or bottles of water because that would take away the profit margin. RFID tags might end up on things that cost above ten dollars, but they wonít be on things that are cheap commodities.

I also think itís important to think about what it means if and when RFID tags make it on to consumer products. I saw a presentation recently where it was pointed out that an RFID tag could be put between the paper plies in a bag of dog food. Very sinister, of course, that this device should be concealed in a dog food bag, right? But think about it: You take the dog food bag home. You pour the dog food into Fifiís bowl. Then you throw the dog food bag away. What difference did it make that there was an RFID tag there? None at all.

I think there will be circumstances where consumers absolutely demand RFID, and there will be times when they absolutely refuse it. I think consumers will want RFID tags embedded in things like shop tools and consumer electronics in order to prevent theft. I renovated a house here in D.C. a year ago, and I was surprised to learn how much theft there is of shop tools. Guys will come and steal stuff off trucks and then come around a week later and try to sell your tools to you.

If tools have RFID in them, they can be permanently correlated to their owners. I doubt if everyone will have a reader with them, but maybe the police could have RFID readers that connect to a database of ownership for valuable movable items. When they find stolen tools, electronics, and such, they could return them to their rightful owners.

In other cases, consumers wonít want RFID. I think shoes are a pretty good example. There is the potential for tracking people through shoes, which donít get traded around very much. It will be probably be inappropriate for shoes to have permanently embedded RFID.

Getting back to the constraints on RFID, I think self-help is another important one. Already, Iíve seen clothes which the security tags can be snipped out of. I have to confess I havenít always done it. They shrivel up when you launder them. But most tags on clothing will probably be easily cut out if they worry people.

It will certainly be possible for people to game RFID systems, if those systems are trying to track people too closely. People could sew many RFID tags into a hat, or trade RFID-tags and RFID-tagged items. Ultimately, there is just not a good probability of real-time RFID surveillance systems. There are also technological solutions, both in the design of RFID systems and in devices to block or jam RFID systems. These will protect consumers from privacy invasion.

Finally, there are laws on the books that prevent harmful behavior using RFID systems or any other technology. The state privacy torts give a cause of action to anyone whose private information is publicized in a wanton way. If a company has made promises about how it uses information in a privacy policy, and if it fails to follow those promises, it has violated the terms of its contract with consumers. State attorneys general and the Federal Trade Commission have power to enforce against deceptive trade practices.

So, in summary, there is less to worry about from RFID than many people imagine. I think the technology will be hemmed in appropriately and deployed for the overall benefit of consumers.

I think weíre in a bit of an RFID boom, like the dot-com boom of a few years ago. When we thought every part of life was going to be conducted online, people got spooked and ran out calling for regulation to bring it under control. Turned out, consumers are still going online more and more, but theyíre doing so at their pace, at the pace theyíre comfortable with. There is a lot of hype and speculation about RFID right now, but give it a little time and the shine will come off this technology. It's an important technology, and potentially powerful, but not all-powerful by any stretch.

The thing you should focus on as legislators is to address real problems as they arise, rather than imaginary ones. Tremendous benefits are available to your constituents if RFID is tested and tried in the marketplace so retailers find the best way to serve consumers what they want at the prices they want.


©2000-2004 Privacilla.org. All content subject to the Privacilla Public License.