RFID Technology

RFID Ubiquity

2008-11-09T11:49:00.000-08:00

It is very likely that RFID will in fact create an architecture of potential surveillance. RFID is slated to take the place of the bar code as well as function within devices where bar codes have, until now, been impractical. This means there will be potentially billions of readable tags in circulation in a few years. Millions are presently circulating. This means that the tag end of the architecture is being rolled out. Now, all that is needed to complete the system is a network of readers.

As an example, think of readers located at the entrances and at various key points in shopping malls. The merchants could quite conceivably agree to share data on all customers regarding all items bought and tagged in that mall. Mall management might also even participate in this reader information gathering initiative in order to study, for example, customer movements. As the information will be shared and as customers with tags will likely return to the mall with at least one recently purchased and tagged item, reader ubiquity could be an extremely easy way to monitor the movements of many customers with a minimal number of readers. One of the main criteria of surveillance architecture – ubiquity – is indeed becoming a reality with RFID.

RFID AS SURVEILLANCE

2008-11-09T11:42:00.000-08:00

At first glance, it may appear that RFID is not a serious tool for surveillance. Critics and vendors state that the surveillance concerns of groups such as CASPIAN and EPIC are overblown. They note, for example, that:

v Most chips are not designed to be self-powered, limiting their range and thus usefulness for tracking;

v Readers are not deployed in public places, nor are they likely to be;

v At present there are no plans for businesses to read each others’ chips, or for the state to monitor business’ chips

v Customers may simply make a habit of removing tags;

v There are no [clearly stated] plans to make tags inaccessible, so small as to be imperceptible, to require them for warranty service, or to make devices inoperable without them.

Yet, it is worthwhile noting that there are no guarantees that these “realities” will hold for the future. Indeed, there are several trends which appear to contradict these assurances, perhaps most notably that the chips will not get smaller, that readers will not become more prevalent, and that they will not become required and essentially integral to the operation of some devices. Since most chips use unencrypted protocols, the assertion that no one presently reads another’s tag does not preclude someone from attempting to do so, or a retailer from being able to read the tags of another retailer. Further, as seen below, claims that the information from RFID chips will not be linked to personal information gathered in other ways (such as through loyalty cards) either by business or government is naïve.

Rather, RFID tags have the potential to play the role of an essentially low-tech tracking device in a system of distributed mass surveillance. At present, such a system is uncoordinated and patchy. However, with only a slight shift in the present reality, a shift that is already occurring, RFID devices and their readers will form the infrastructure of a massive public surveillance architecture. Only by laying down clear legal ground rules now can consumers avoid a system to be deployed to track them.

The Soul of the Chip

2008-11-04T11:18:00.000-08:00

RFID is not, at least at one level, intended in most instances to identify and track persons, but simply things. Also, the undertaking to track individuals may be a difficult or even risky strategy if it is discovered and deemed objectionable by consumers.75 However, this attitude tends to overshadow the realization on the part of most observers that RFID is at its core about tracking things. This very fundamental point should not be glossed over. By it’s nature, RFID is a tracking tool. What makes RFID potentially a surveillance tool is that people interact with those things in observable and meaningful ways. 76 Employees load and manage agged objects in stores. Customers, however, have a more long lasting and mportant relationship with tagged objects – they walk around with them inside stores; they buy them, take them home and out with them again.

Many consumer goods travel with the consumer outside the home. Cell phones, MP3 players and game consoles accompany many people to nearly every destination. Durable clothing such as shoes or coats are also worn frequently. What this means is that consumers will likely be unaware of the tracking capability of RFIDs in these common things, due simply to their everyday nature.

Likewise, there is no admission, and possibly no recognition, on the part of business that they are creating a surveillance mechanism not of items but of people – at least once consumers purchase a tagged item. It is this steadfast repetition of the mantra that ‘RFID tracks things, not people’, that makes it dangerous. This doctrine allows the architecture to be aggressively rolled out by business, and RFID tags kept live and ostensibly to be used for many ‘valid business purposes’ (such as warranty service or special offers), without acknowledging the associated surveillance potential.

Thus, the question must be asked: do businesses know of the surveillance potential of RFID? Even if the answer is no, and they do not yet recognize the surveillance potential of RFID, there is cause for concern. It is also worrisome to unwittingly build an architecture of surveillance by pursuing other business or government goals which incidentally facilitate mass surveillance.

RFID and ‘Lawful Access’

2008-11-04T11:17:00.000-08:00

Consumers and citizens should also be aware of the essential similarity of the information made available by RFID chips, and the ‘tracking and location’ information sought to be accessed by law enforcement officials in Canada under the federal government’s recent ‘lawful access’ proposals. Those proposals recently culminated in Bill C-74, the Modernization of Investigative Techniques Act (MITA). Although MITA died on the order paper in December 2005, there is little doubt the legislation will be re-introduced in the next Parliament.

Consumer and civil liberties groups have heavily criticized the Act, and the lawful access proposals that preceded it, for being overbroad and lacking judicial oversight and reporting mechanisms. The likelihood that RFID tags will be considered a “telecommunications facility”, under the Act, or that the readers will be considered part of a “telecommunications service” or at the least a “transmission apparatus”, appears at least plausible. Equally plausible is that MITA would be amended slightly, given the similarity of information provided by RFID tags to the definitions of ‘location information’ and ‘tracking information’ under MITA. Therefore, consumers and citizens should realize that the creation of an essentially business consumer-reporting architecture could be appropriated to the “public safety” goals of the state with little difficulty.

RFID IMPLEMENTATION

2008-11-04T11:14:00.000-08:00

Given the potential for creation of a surveillance architecture with RFID (even if that architecture is initially patchy, or only partly used, or not coordinated between vendors), and given the likely temptation of marketers and governments to compile tracking information on individuals, it is prudent for consumers and citizens to demand the utmost in transparency and to require clear rules on the limits of the acceptable use of such information. To accept that such a high level of privacy control over RFID is required, consumers and citizens must be persuaded that RFID is indeed like other kinds of surveillance. If this can be demonstrated, the question becomes the extent to which present privacy law in Canada can be privacy-vigilant enough to halt mass surveillance use of RFID and whether privacy law should be modified considering RFID architecture and it surveillance possibilities. It is to these questions that this paper now turns.

RFID and Video Surveillance

RFID does not provide an actual visual image of a person going about their business, and so is less privacy-invasive than video surveillance. However, that does not mean that RFID cannot provide the ‘observer’ – that is, the person with access to RFID data – with a mental picture of the individual carrying a RFID tag. This could be achieved, for example, by associating the RFID chip with an individual, using either the individual’s personal information from credit payment or loyalty card information at point of sale, or more directly, by encoding the RFID chip either at the point of sale or earlier with personal information. This is the METRO “Payback” loyalty card approach described above.

With such an identifiable RFID chip located on a person, RFID reader systems can tell things the eye can see and also, significantly, provide a detailed record of things the eye cannot see. One can track movements of an individual via RFID chip as with video surveillance, but one can also ascertain how long the individual took to proceed from RFID station to RFID station, and then link that to the individual at the point of sale.83 Although no retailers admit to linking the RFID ath-tracking and timing to individual profiles,84 there is no impediment, technologically, to doing so.

Notably, in combination with the video surveillance that is prevalent in a retail environment, RFID enables another, powerfully detailed dimension to video surveillance. However, even without accompanying video surveillance, RFID would allow a retailer to track customers’ movements through a store and even whether they had picked up an item, regardless of whether the customer entered a camera “blind zone” or had successfully hidden an item in a pocket, bag or purse.

RFID and Location-Based Tracking Devices

2008-11-04T11:12:00.000-08:00

Unlike RFID’s somewhat haphazard tracking capabilities, there are systems that are specifically designed to track location. Such “location-based services” are designed to report a subject’s position with incredible precision (i.e. to less than 150 metres) on a regular basis.

These are cellphones and other Global Positioning System (GPS) devices that report location to computer systems that parse the signals into useful tracking information like direction of travel, speed and of course location at the time of communication with the device. Unlike RFID, these systems are designed to act over large distances and to track one device continuously. Professor Colin J. Bennett of the University of Victoria has studied the LBS technology (Location Based Service) in

Canada

and has concluded that:

From the [LBS] examples listed above the potential challenges to existing egulatory frameworks, such as that framed by the PIPEDA in

Canada

are enormous. Locational data can be extraordinarily sensitive. It can be monitored remotely, without the individual’s knowledge and consent. It may be collected continuously and stored indefinitely. The level of consumer education and experience is low. And the potential value of such information government and for business is enormous.

Colin Bennett has noted that the application of PIPEDA to LBS may yield a requirement that explicit consent is required for tracking ‘sensitive’ informationbecause the category of what is ‘sensitive’ personal information must be viewed in light of the locational context that LBS makes possible.87 He has also noted that PIPEDA may not fully capture the concept of “trajectory” as personal information; that is, the apparent and actual destination, as well as route taken by persons carrying LBS-equipped devices.88 Bennett notes other problems with application of the general PIPEDA principles to LBS, such as the degree of accuracy required of LBS records, which are presently not able to exactly pinpoint an individual – leaving open the possibility of false inferences regarding an individual who simply passes near a ‘sensitive’ area.89 Similar concerns would seem to apply to RFID, as the locational data would be quite similar to that collected under LBS systems.

What has not been examined with regard to LBS is the potential for it to be ombined with RFID’s short-range detailed information. One use would then be to help to “de-anonymize” RFID carriers by potentially cross-referencing them with, for example, a location-reporting cell phone. RFID can then be used to determine an individual’s location when out of LBS range, but more importantly perhaps, will allow nearly microscopic sub-tracking of individuals within an FIDreader enabled zone (such as a shopping mall). Any cross-referencing between the systems could allow the LBS provider to know what RFID tagged object the LBS subject was carrying in addition to their exact route, making for a very powerful tracking “system” indeed.

Future Networks, Power DHL & RFID

2008-11-04T11:08:00.000-08:00

DHL has always been at the forefront of technology - DHL delivered the world’s fi rst Arabic computer and the fi rst commercially available Web and WAP shipment tracking capability. One of the latest technologies promising to provide our customers with a competitive advantage is Radio Frequency Identifi cation (RFID).

What is RFID and how will it help you?

Radio Frequency Identifi cation (RFID) is a silicon chip-based transponder that communicates via radio waves. RFID has been commercially available for many years, but the latest RFID developments now offer the compatibility with an express logistics and transport system to enable the following potential improvements to service:

Increased security of your package and items within your shipment
Visibility of items within your shipment without opening the package (note: source tagging of items required)
Later cut-offs due to automated and simultaneous identifi cation
“Near” real time track and trace, which is dynamic, automated and proactive, through links to GPS (global positioning system) and communications systems
Condition monitoring (eg, temperature, vibration, humidity) through links to micro sensors
Counterfeit protection through validation of genuine goods throughout the logistics process - Intellectual Property Rights (IPR)
Dynamic multi-modal merge in transit

DHL has been exploring RFID with multiple component trials since 1998. We are backing international standards that will provide a truly ‘open’ system for express logistics and transport, and this has been demonstrated to have a close match with our customer’s processes.

Saluting the CHIEFS

The CHIEFS project formed part of the UK Home Offi ce’s Chipping of Goods Initiative and was initiated in 2001. Nokia and DHL delivered a successful pilot in May 2002, proving the potential of an RFID tag system coupled with GPS. It moved DHL closer to providing a complete view of the end-to-end piece process in the supply chain and proof of ownership. However, cost and form factors limited wider deployment. Meanwhile, DHL has been sponsoring its own successul RFID development, including an aircraft container RFID system linked to GPS. This forward-looking work coupled with the initial CHIEFS success has created CHIEFS 2. As a result, March 2003 sees DHL demonstrating a system with truly global potential for the future advantage of all our customers. RFID devices will be incorporated into individual Nokia phones, not only allowing control of phones throughout the distribution process, but also reducing crime since phones will have a unique identifi cation number for tracking. All Nokia shipments will be entrusted to DHL from shipment processing through to delivery. This will offer innovative solutions to our customers in the very near future.

Other key benefi ts of CHIEFS 2 are:

• Low cost passive tags complying with ISO standards

• Wafer-thin tags that can be incorporated within labels or customer products

• Simultaneous printing and encoding of tag labels at DHL and our customer

• Automated instantaneous confi rmation of receipt, departure, arrival and final delivery

Recent Developments in RFID

2008-11-04T11:06:00.000-08:00

Wal-Mart, the world’s second largest company, is deploying RFID technology in its stores. “Wal-Mart is positioning itself at the front of an inevitable technological revolution, even if it means dragging others into a future they’re not sure they want,” said Dillman, Chief Information Officer, Wal-Mart. Furthermore, Dillman states, “I had no idea we’d get a reaction like this. But the fact that this is happening in public doesn’t change our focus on making sure it happens.” Dillman is referring to some resistance from consumer advocates who are concerned about privacy issues and suppliers who are concerned about the fair cost for their end of the technology – the RFID tags.

The Department of Defense is embracing this emerging technology as well. “The Defense Department recently announced it would require its suppliers to use wireless tags based on radio frequency identification (RFID) technology by January 2005. The policy calls for Defense Department suppliers to put RFID tags on the ’lowest possible piece‘ - each part, case or pallet, for example - and pertains to all items except bulk commodities such as gravel. The goal is better inventory management through faster, hands-off processing.” The Department of Defense purchases not only just multi-million dollar military equipment, but over $20 billion dollars in consumer products and is seeking to make the supply chain more efficient.

Companies like Microsoft, IBM, and Philips Electronics, which recently made product enhancement announcements in this area, are also participants in the industry. “IBM, in Armonk, New York, and Philips, in Amsterdam, will team on RFID for supply chain management, retail and asset management, as well as smart card technology for finance, e-government, transportation and event ticketing.” the company said. “As part of the joint effort, IBM Global Services will build an RFID system for use in for Phillips’ semiconductors facilities for manufacturing and distribution in

Taiwan

and Hong Kong.”

RFID Challenges

2008-11-04T11:04:00.000-08:00

Before RFID deployment resumes its growth, several obstacles need to be overcome. Will Cappelli, an Analyst of the Meta Group has summarized some of the issues:

First, the market will require standardization and stabilization, with regard to both the actual technology and functionality deployed within the various RFID chips and the syntax and semantics of the RFID signals themselves. At present, global organizations face the prospect of having to monitor, manage, and translate between two different signal grammars depending on how their intelligent objects are distributed among the regions of Europe and the rest of the world.

Second, RFID technology’s potential ability to enable automated gathering of information about post-sale product usage has already stirred up privacy anxieties. Legislation limiting or even preventing the deployment of RFID has begun to wend its way through both national and regional legislative bodies.

Third, RFID signal and reader technology - taking into account some of the more recent enhancements previously mentioned - operates at a low semantic level. At the same time, the volume of signals generated is large. To actually make use of much of the information contained within the signals, vendors will need to develop (and organizations will need to implement) a rich twodimensional infrastructure. In order for the potential benefits of RFID to be realized by the economy, these challenges will need to be effectively addressed by industry

The Future of RFID

2008-11-04T11:00:00.000-08:00

RFID technologies are expected to grow quickly over the next few years as companies seek to improve their supply chain operations, and as the price of RFID drops. According to an analysis from Venture Development Corporation (VDC), “Global shipments of RFID systems (including transponders, readers, software, and services) reached $890 million in 2000.”12 The forecast from VDC’s market study entitled “Global Markets and Applications for Radio Frequency Identification Equipment and Systems” predicts shipments of RFID to increase by approximately by 24% annually to reach $2.65 billion by 2005.

The applications for RFID in 2000 reached most economic sectors although the most use was in industrial/manufacturing, transportation, distribution, and warehousing industries. Smart label applications as well as high-speed processing will fuel growth in these sectors. Other growth sectors include health care, commercial, and retail services. For example RFID could be used as a tool against product counterfeiting by permitting more precise identification and verification of the sources of shipments.

According to VDC, “Virtually every economic sector and industry where data need to be collected contains potential applications for RFID technology.” VDC’s research reveals that RFID hardware shipments were concentrated among industrial/manufacturing and transportation, distribution, and warehousing organizations in 2000 (see Exhibit 1). Future revenue growth within these economic sectors will primarily be driven by the development of the smart label market, particularly to support growing applications such as baggage handling and high-speed processing. In addition, these two economic sectors are expected to account for the largest percentages of RFID hardware revenues in the near and long term; however, their annual growth will be slower in comparison to the annual growth of the emerging health care, commercial, and retail services sectorsIn terms of the future growth of the health care, commercial, and retail services sectors, the following points are relevant:

v Interest is increasing among healthcare organizations to support applications such as waste management, high-value asset tracking, record/document tracking, and real-time location systems.

v The commercial services segment is expected to grow rapidly through the emergence of consumer applications such as automated payment systems, m-commerce (mobile commerce), libraries, rental item tracking, and reusable media.

v Adoption of RFID systems in retail environments has been limited and con centrated primarily in security/access control applications. Future develop ments in the retail sector are largely focused on creating smarter EAS (elec tronic article surveillance) transponders to support, for example, the storage of pertinent product information within a retail item, such as warranty information.”

“While the potential for viable RFID applications within economic sectors appears virtually limitless, few applications have translated into consistent and profitable opportunities, with price often being the decisive barrier. Of the current applications, the majority of RFID shipments are attributed to the well-established, traditional security/access control and transportation applications where RFID has proven success (see Exhibit 2). By 2005, supply chain management applications are expected to join these applications in holding the lion’s share of RFID market revenues, especially as the market for smart labels grows.

“Over the next five years, point of sale (POS), rental item tracking, and baggage handling applications are anticipated to exhibit the fastest annual growth. Given the growth forecasts of these application segments, it is not surprising that current and potential RFID end users seem most interested in these applications’ possibilities. However, potential end users are evaluating RFID for use in virtually every application segment to improve efficiency, especially in supply chain management. Widely used and established applications such as security/access control and asset management are still being evaluated and will continue to grow, but perhaps not at the rate of the emerging applications.

EPCglobal and RFID

2008-11-04T10:56:00.000-08:00

EPCglobal is a joint venture between EAN International and the Uniform Code Council (UCC). It is a not-for-profit organization entrusted by industry to establish and support the EPC Network as the global standard for immediate, automatic, and accurate identification of any item in the supply chain of any company, in any industry, anywhere in the world. EPCglobal’s objective is to drive global adoption of the EPCglobal Network.

EPCglobal is also an organization that is leading the development of industry-driven standards for the Electronic Product Code Network. This network supports the use of RFID in today’s “fast-moving, information rich trading networks. EPCglobal is a member driven organization of industry participants that is creating global standards towards providing efficiency gains in supply chains and relationships with trading partners.

The EPCglobal Network was developed by the Auto-ID Center, an academic research project headquartered at the Massachusetts Institute of Technology (M.I.T.) with labs at five leading research universities around the globe. The EPCglobal Network is a set of technologies that enable immediate, automatic identification and sharing of information on items in the supply chain. In that way, the EPCglobal Network will make organizations more effective by enabling true visibility of information about items in the supply chain.

Health Risks of RFID

2008-11-04T10:46:00.000-08:00

To date, minimal effort has been expended on the possible health risks of RFID and similar “electronic article surveillance” (EAS). Exploring risks of radio wave exposure in humans will likely take a concerted effort and be difficult to state definitively. That does not mean that RFID and EAS could not pose a health risk, especially if the readers and their tags become as ubiquitous as the industry predicts.

The European Community is the first jurisdiction to address the issue directly, in EC paper, Possible Health Risks to the General Public from the Use of Security and Similar Devices.

This document is a summary of potential problems with exposure to RFID and EAS devices. The report notes that at the frequencies used presently for owgrade passive RFID (i.e. between 100kHz and 10 MHz) that a combination of “membrane excitation” and heating can occur. Above 10MHz, “heating effects are well established”. However, the report concludes that generally exposure levels from high frequency security devices would be “many times below those that would induce a physiologically relevant heating”. The EC report therefore recommends further study of electromagnetic radiation from RFID and similar devices at the design stage. The report also recommends that exposure studiesto be undertaken to specifically study the effect upon children, as children will also be exposed to RFID and their potential sensitivity to electromagnetic ields. It would also seem sensible to study those likely to have chronic exposure levels, such as check-out cashiers.

The EC report additionally suggests that larger problems may exist with RFID
interaction with medical devices:

The reported cases of electromagnetic interference with certain critical medical devices remain a concern. More data are needed on the emissions of EAS, RFID or metal detector systems and on the interference with all kinds of active implantable medical devices. The data must be publicly available to make informed choices.

Certainly consumers are concerned about radio wave exposure from RFID devices.70 However, all that can be said at present is that the issue of healthy exposure levels for RFID systems, as well as guidelines for their interaction with medical devices, has yet to be undertaken. Thus, introducing RFID technology in advance of these health studies means taking some kind of risk, whether that risk is large or small, with public health.

RFID Technology

2008-11-03T19:36:00.000-08:00

RFID is an automatic identification method that relies on tags that are attached or incorporated into products, animals or people, and RFID transceivers There are wide range of RFID systems commercially available. At the lower end, primitive RFID systems have little more functionality than bar code systems,while at the op end, they can be equivalent to “smart cards”.

An RFID system consists, at a inimum, of transponders (commonly called tags), and readers (technically eferred to as “interrogators”). The reader contains an antenna and a transceiver r decoder, as well as memory and some processing capability. In most pplications, it sends out a signal several times a second, querying tags.

RFID ags can be passive or active. A passive tag does not have its own source of ower, but rather uses energy from the signal sent by the reader to send a reply. s a result, the range is limited. In theory, the range is up to ten feet, but in practice, the range is often less, sometimes only a few inches.

A passive tag has inimal memory and little or no processing capability. The tag must have a unique dentifier or number that corresponds to that tag, and, by ssociation, to the object or person to which the tag is attached. Low-end tags may have no other information. Rather, the reader uses the identifier to look up the object in a database, where a more or less extensive description can be found. The reader may update the database after detecting an item, adding the new observation and the circumstances surrounding it (e.g. time and place).

Some passive tags allow the writing of new information into their memory by the reader, so that the tag is updated. As an example, an event log may be maintained. More importantly, the identifier may be deactivated, temporarily or permanently, by making appropriate changes in the header.

Active tags have thin-film batteries or “Power Paper” to power them, allowing for very thin tags. They are generally more expensive than passive tags, but have better radio characteristics, in particular a bigger range. They have processing capabilities, and may include other functional components, e.g., sensors. Functionality is much improved if readers are networked, with access to a central database. In such a case, a simple identifier on a tag can be used to elicit a wealth of information on the item tagged. Information obtained by readers can be sed to update the central database in real time as well.

Because RFID systems are diverse, there are as of yet no international standards for them. However, work on international standards has been ongoing since the 1990s, and several protocols are becoming de facto industry standards in the meantime.