Privacilla.Org

Home
Past Releases and Reports
Coverage
About Privacilla
Privacy Fundamentals
Privacy and Government
Privacy and Business
Online Privacy
Financial Privacy
Medical Privacy
Report your thoughts to Privacilla!
Your Source for Privacy Policy from a Free-market, Pro-technology Perspective


Click to return to list of releases and reports

Home > Past Releases and Reports > Remarks to the Experian Consumer Advisory Council's Panel Discussion on RFID


Remarks of Jim Harper, Editor of Privacilla.org, to the Experian Consumer Advisory Council's Panel Discussion on RFID

October 8, 2004

Well, having seen Katherine Albrechtís very thorough presentation today, Iím officially scared. But, seriously, I donít think there is as much reason to worry about RFID as she suggests.

I do want to be clear about what Iím saying to you here. Itís not that RFID is not a privacy problem. There are reasons to be concerned about it, but they are not overwhelming. RFID presents us with a manageable privacy problem.

As I heard her speak, I thought of the technology that lead to the first argument for legal protection of privacy in 1890. The authors of the Harvard Law Review article called ďThe Right to PrivacyĒ were very worried about photography and its power to capture and copy peopleís images.

I imagine that if there were a big group of photography companies swarming around touting all kinds of photography applications at that time, people would have been just as freaked out about photography as people seem to be getting about RFID. You can almost hear the wild predictions: Miniature cameras will be everywhere! Soon, you will not be able to move without someone capturing a photo of you! The end of privacy! And so on.

Obviously, itís not that way today. Photography has improved life in America and around the world. Photography presents privacy concerns, but they are manageable. I donít think anyone is arguing for a ban on the technology.

I do believe that a lot of the fault for the privacy hype is with the creators and builders of speculative RFID devices and applications. Itís important to realize that theyíre salespeople, trying to get funding for their projects and sales channels for their products. So I think itís important not to take at face value what theyíre saying. Some if it is really quite preposterous.

My favorite is the maker of RFID gambling chips that claims casinos will be able to track every bet and every player. No one seems to have stopped to think about how that would be possible.

You donít have to be a gambler to recognize that chips, purchased with cash, move around gaming tables essentially at random. Even if you could track who had purchased a stack of chips, those chips would be distributed among the house and other players in a matter of minutes. When players place bets on a table, no realistic RFID system could sort out stacks of chips placed inches apart from one another. So donít take at face value the claims of the RFID manufacturers.

Iím going to do a two-parter for you here: First, I want to talk about where RFID technology is actually going. Then, I want to talk about why RFID wonít go much further than consumers want it to. I have a paper out where Iíve discussed the social forces that will channel RFID, just like they do all technologies, toward uses that are beneficial to consumers.

First, though, where RFID is going: Let me point out to you a paper that was put out this week by the Progressive Policy Institute. It is a very accessible look into the current state of RFID and why itís good for us.

There is a fascinating field of business out there, not very familiar to most of us, called supply chain management. That is the art of getting things from where they are to where they need to be. We have a huge economy that moves tons and tons of goods to consumers. I think Iíve heard the number placed at $1 trillion, and it could be even more.

There is still a lot of inefficiency in moving all this stuff to all the places it needs to go. It takes millions of hours per year for workers to go searching through warehouses looking for cases and pallets of goods that should be out on sales floors. Cases and pallets sit on trucks and in train cars for hours and days because people donít know where they are. With many products, thereís the problem of spoilage, and we lose probably billions to inefficiency and waste in shipping perishable goods.

I donít know how many of you have ever moved from one house to another. But were you able to put your finger on your kitchen scissors when you got to the new place? How quickly could you find the clock radio? Thatís the kind of problem that logistics managers deal with every day.

Right now, as I understand it, Wal-Mart, the leading proponent of RFID, is asking its suppliers to use RFID so that a pallet can be identified as it passes through a warehouse door, and so a carton on a conveyor belt can be identified. This is going to help them figure out where all the goods they sell are, all the time.

And, when they do, I think itís important to point out, the benefits will be passed on to consumers. As the PPI paper says better than I could, retail is an industry with very tight margins and tough competition. Companies are racing to implement RFID because they know it will only bring them competitive advantage for a brief time. When everyone is using RFID to squeeze out inefficiency, competition will drive prices down, delivering the benefits of RFID right into the hands of consumers.

The savings are just part of the benefits from RFID. There will obviously be safety benefits, as drugs might be labeled with RFID to prevent counterfeiting and tampering. RFID can assist when there are recalls because specific lots and shipments can be precisely identified, and perhaps even the purchasers can be found and directly notified that they have a defective product. These are some potential life-saving benefits.

So I think itís important to look at the benefit side of the equation.

Again, though, RFID is not not a privacy problem. Itís a manageable privacy problem. Let me describe why I think itís manageable.

I did issue a paper recently through the Competitive Enterprise Institute that goes through the social forces likely to constrain RFID. Itís hard to do this kind of analysis because I had to write a speculative response to speculations about what will happen to the technology. But I have categorized the influences that will likely hold sway over RFID. No technology is used to its maximum potential, for a variety of reasons.

The first one and most prominent, I think, is economics. Frankly, it is and always will be an expense to manufacture and install RFID chips, to operate RFID readers, and to collect and maintain data using RFID systems. That last one should not be forgotten. I saw a presentation recently where a Defense Department speaker reported having to throw away 70% of the data collected by RFID systems because itís worthless junk.

But, right now, as I understand it, RFID tags cost about twenty cents a piece. The holy grail is to get them down to about five cents. What that means, of course, is the RFID chips will not be planted everywhere on every consumer good. Considering the narrow margins, installing a chip could take away the entire profit from an item. Every single water bottle will not have an RFID chip on it. And packs of gum will not have RFID tags in them even if thatís technically possible.

Readers are about a thousand dollars right now. They will come down in price, of course, but they will never be free. Stores will not have RFID readers in the parking lot, down the street, on the roof, or anywhere else that doesnít serve a legitimate purpose. A lot of the scare stories about total surveillance using RFID assume that scanners will be everywhere. Well, they will always cost money, so they will not be everywhere.

As I noted, it costs money to store and process data. Thatís not free either. So if data collected by an RFID system doesnít serve a legitimate purpose, itís going to be thrown out immediately. Thatís going to be priority one in the design of these systems because failing to do so just adds needless expense.

The users of RFID are motivated by greed Ė self-interest is the nicer way to say it Ė but youíd be mistaken to assume thatís bad. That greed will cause them not to use RFID in more instances than they might use it.

Economics Ė or greed Ė also will influence the design of RFID systems. There are some read-write chips that allow storage of new information after they are manufactured. These will not be used in the consumer goods environment. They are just too expensive compared to the dumb chips that do everything retailers are going to want to get done.

Think also of how RFID will be used in the consumer goods environment. You need a system that reads tags as they pass under a check-out arch or whatever, but you need to make sure that they are not scanned by that same arch as someone carrying a tagged product walks nearby. The practicalities mean that short read-ranges are at a premium. Some of the projections about people scanning tags from great distances are very unlikely to come to fruition.

So those are some of the ways that greed will constrain RFID. Jealousy will help too.

Some people assume that there will be a worldwide open database correlating tag numbers to the goods they are on. If RFID users are thinking about it, this will not happen.

Letís say I have a menís fashion store and I have an RFID reader. By scanning tags on people coming in, I notice that people wearing a type of pant that I sell are also wearing a leather jacket that a competitor of mine sells. This tells me that I need to bring leather jackets into my product line, and it takes away from the competitive advantage that the other store had on me.

No, the more likely route is for RFID systems to be closed. So a scan that takes place off the premises of a retailer reveals nothing more than the presence of an RFID tag and the junk serial number on the tag.

The data structure and format of RFID systems is most likely to be proprietary. It wonít be easy to correlate RFID tags to the goods that theyíre with.

I heard a state legislator recently speculate about a situation where someone with a bottle of prescription drugs like Oxycontin might get jumped by thugs who scanned the person and discovered what they were carrying. Itís not going to happen because the data needed to do that is not going to be available. Likewise, thugs will not be able to drive through alleys and take inventory of the houses and apartments they pass.

So, these are just a few of the ways that economics, self-interest, or greed Ė whatever you want to call it Ė will steer RFID in the right direction. But Iíve only covered the costs of the technology and its operation. There is also the whole area of consumer demand.

I think consumers will want RFID in some instances; they will not want RFID in some instances; and they will be rationally indifferent to RFID in most instances.

It seems like RFID will be pretty attractive to consumers if it can be deeply embedded in computers, shop tools, and stereo components. Then, if these things are stolen, the RFID tag can be correlated to the true owner and returned, while the person possessing the goods goes to jail.

I renovated my house last year, and learned from my subcontractors about the active market for stolen tools. Theyíll break into your van one week and then come around and sell you your stuff the next. Just imagine if expensive tools could be tagged and matched to their rightful owners. Same goes for expensive electronics like laptop computers and stereo components. These are examples of where consumers may really want RFID.

There are examples where consumers wonít want RFID, of course. It seems like shoes are a particularly bad place for embedded RFID. There is a risk of surveillance from RFID-tagged shoes, which obviously stay on one person for much of the time. So I suspect that consumers will resist this type of application.

Most places, consumers might not care very much. We saw a slide showing that RFID tags can go in between the sheets of paper in a dog food bag. Well, letís say you buy that dog food, carry it home, and put it next to Fluffyís kennel. When Fluffy is done eating the dog food, you throw the bag away. What difference does it make that there was an RFID tag on it? None at all. It just doesnít matter if RFID is used in a dog food bag. It seems like most disposable items and packaging are places where consumers will rightly ignore the RFID question.

Consumer preferences extend to a lot of different contexts. Weíve heard that RFID chips may be inserted into currency and used to track us. I have heard about this particularly from Europeans. I donít know about Europe, but I do know that in the United States, that notion is a complete non-starter. There would be no tolerance among Americans for RFID tags to be embedded in our currency. Sure, some propeller-head at the Federal Reserve or someplace wrote a paper about doing such a thing, and degrading the value of notes that are horded, blah blah blah, but it is just not going to happen.

Thereís no end to the idiotic ideas that come out of government and business alike. We saw a video today where a shelf was designed to alert for potential theft if three packages of razors were picked up at the same time. Well, the techie who put that shelf together belongs right there in the research lab, because he would be an instant failure in the real world. Accusing your best customers of crime: yeah, real good for business.

The next social force that will control RFID is the variety of counter-measures consumers can use if RFID use goes beyond their desires. Aluminized mylar bags are already given out along with the ďSpeedpassĒ-type systems so that drivers can disable them when they donít want to use them at toll booths. This is simple, straightforward anti-RFID tech.

People can use scissors, of course. I have a shirt with a security tag sewn into a little pouch with an instruction to snip it out after purchase. More simple, anti-RFID tech.

There are a number of more complicated technologies under design. There may be blocker tags that jam RFID systems. And RFID scanner detectors will be able to turn up the use of RFID scanners in strange places. Thereís a guy named Richard Smith who took it upon himself to pick apart all kinds of different software programs and Web sites to see what they do. Every time he caught a company doing something unacceptable, the whole industry learned a valuable lesson. One or two people like Katherine who are concerned about misuse of RFID could ďoutĒ companies that scan for RFID in unacceptable places. This would chasten entire industries.

Finally, it would be easy, if it ever came to it, to confuse any kind of RFID surveillance system. You could make friends with someone in a coat room, and drop random RFID tags into clothing each night, sending thousands of RFID zombies onto the streets. People could sew multiple RFID tags into hats and trade them around to frustrate RFID-based surveillance. RFID ends up being pretty good at tracking inert objects in a warehouse; not good at all for tracking the movements of people in human environments.

The last social force guiding RFID is existing law. Law operates in two ways. First, it gives people autonomy to choose or refuse RFID. A lot of the argument against RFID seems to assume that people would just be able to walk into our homes and scan all the RFID tags there. Well, thatís not the case. Consumers can decide whether they want RFID tags to enter the home and whether they want RFID readers to enter the home. This is all thanks to property rights.

We also have autonomy as to our persons. I mean, the story about how people at a bar implanted themselves with RFID tags is pretty weird, but it was their choice to do so. If someone were to implant you with RFID against your will, that would be a tort and possibly a crime. If someone from the government were to do so, that would be a violation of your civil rights. So this talk of a mandatory RFID infrastructure just denies the choice and autonomy we have in so many areas.

The second way that law operates is to address harms done to our interests. The state privacy torts are a great example of how the law protects us. If anyone, using any technology, makes an outrageous disclosure of information about us, we have a cause of action against them. The general criminal laws provide us protection against uses of RFID, or any technology, in furtherance of a crime. So RFID used to commit burglary, identity fraud, murder, or anything else is already against the law.

So, in summary, there are a whole lot of ways that RFID will be hemmed in when it really comes into use. If you take at face value all the things that makers of RFID technologies put out there, you can get pretty startled. But you donít have to believe them. In fact, youíd be a little bit foolish to be taken in.

This morning, I was wondering to myself why I felt so strongly about RFID. There are a million different issues that I work on and Iím only half an inch deep on any of them. So why spend all this time on RFID? I think itís because of the benefits to consumers that we will begin to see very quickly from its use.

I didnít grow up poor, but my parents did. So we lived like we were poor. I wore hand-me-downs to high school my freshman year Ė and Iím permanently scarred by that. I guess my upbringing causes me to know that there are consumers out there who care about saving a few nickels and dimes. New immigrants, poor minorities, these are people who can benefit from rapid adoption of RFID because it will return badly needed dollars to their pockets.

I think itís always going to be important to protect against privacy risks, but I think we should pursue the benefits that can be gotten from RFID technology just as aggressively as we protect against any harms.


©2000-2004 Privacilla.org. All content subject to the Privacilla Public License.