RFID and privacy: a look at where the "chips" are falling. (radio frequency identification)

I. INTRODUCTION

Radio frequency identification (RFID) technology is expanding across the globe as tiny electronic chips capable of functioning as miniature radio transmitters are being attached, or tagged, to nearly any object that moves. Nothing seems immune from the tagging and tracking process as public and private interests tag such diverse objects as stuffed birds, (1) cadavers, (2) and even hospital patients as they enter the emergency room. (3) Ordinarily, using technology to streamline the distribution of products and materials represents a benefit to businesses and consumers alike, and using RFID technology for tagging pallets or shipping containers is fairly uncontroversial (4). In fact, major retailers, such as Wal-Mart, use RFID in their distribution networks (5). Further, the U.S. Department of Defense uses RFID to move supplies and ordnance in support of overseas deployment (6) It is the expansion of RFID technology beyond the limited use in tracking containers in a distribution network that raises concerns and triggers comments by privacy advocates (7). Issues arise when an individual end user acquires an item that is tagged with an RFID chip, and the RFID chip stays on the item. The primary concern is that the RFID chip may remain active and the tiny radio transmitter contained on the chip could conceivably be used to track an individual. There are a variety of ways to address the concerns associated with the global use of RFID tags, with proposals to control RFID usage ranging from voluntary industry standards, to state-by-state regulation, to a comprehensive federal approach.

Part I of this article traces the development of RFID technology from its introduction in the supply chain to its universal uses throughout modern society. Part II analyzes the shift from container tagging in the transportation sector to the advent of item-level tagging in the retail sector to reveal how the nearly universal tagging of individual consumer products triggers significant privacy concerns. Part III examines the use of RFID in the U.S. military's massive supply system. Part IV examines the common, widespread use of RFID tags in libraries, where RFID tags are attached to individual books and materials. Part V examines how the use of RFID tags in libraries poses a significant challenge to protecting patron privacy. Part VI explores the issue of consumer privacy by utilizing available policies and procedures of government, industry, and privacy rights advocates to join the issues and determine the effectiveness of safeguards available in various situations that implement RFID technology.

II. RFID TECHNOLOGY: AN OVERVIEW

The use of RFID technology began during World War II as a means to identify approaching aircraft and determine if they were "friend-or-foe." (8) The system was designed to use radio frequency signals between ground stations and aircraft equipped with radio receivers to quickly and accurately identify incoming aircraft. (9) In today's environment, RFID technology has been adapted to allow for the fast and reliable exchange of information from an RFID tag to an RFID reader to identify objects in the supply chain. (10)

RFID tags are small electronic devices that are designed to receive and transmit data using radio frequencies. There are two categories of RFID tags in use: active and passive. (11) "Active tags have a battery on the tag." (12) "The battery may be used to boost read/write range, allow for larger memories, or add sensory and data logging capabilities." (13) receive all of their energy from the read/write device that 'powers' the tag to allow it to transmit data." (14) High-volume applications almost exclusively use passive tags. In practice, the passive tag is attached to an item as a unique identifier of that specific item. Detailed information about the item is encoded to the attached tag and automatically transmitted to a read/write device when the tag is activated and within range. A typical system can read the RFID tags at distances from 6 to 8 inches and up to 20 feet or more. (15) As inventory control components, RFID tags have universal appeal.

One of the key factors in any distribution system is the ability to Keep track of products and materials, and establish procedures to ensure the quick and efficient delivery of shipments. The introduction of RFID technology is designed to increase operational efficiency by tagging individual boxes, shipping containers, or pallets with RFID tags that are capable of transmitting their unique identifying number to a strategically located RFID reader in the distribution network. As containers are loaded onto trucks or railroad cars, the RFID reader automatically captures the identifier and records the location of each container. Of course, the containers are frequently loaded and unloaded in the normal course of distribution, but the unique RFID tag in each container makes the status and location of each shipment ascertainable. In this type of system, the items inside the container change, the origin and destination change, but the advantage of the RFID tag is that it allows each shipment to be tracked throughout the system and the containers to be used over and over again. More important, however, is the fact that the RFID reader automatically reads the container's RFID tag and records it in the system and maps the container's location in real time. (16) Thus, there is a closed distribution system that constantly reuses shipping containers, but the contents change with each shipment. (17) This achieves efficiency because stationary readers automatically read the RFID tags, but with the flexibility to use a hand held reader if necessary. (18) Using RFID tags in this scenario causes little or no concern for privacy. In fact, this is how the technology was originally conceived.

Wal-Mart was an early adopter of RFID technology. When the concept of using RFID in distribution systems was initially introduced to industry, Wal-Mart recognized its potential almost immediately. (19) Wal-Mart decided to establish an RFID system on a trial basis in the Texas area to determine if the technology was viable for the company's business model. A central component of the system was the identification of shipping containers and boxes from the different vendors that sold products to Wal-Mart. To test its RFID plan, Wal-Mart required its suppliers to begin using RFID tags on all shipments to the giant retailer's Texas testing sites. (20) Around this time, RFID technology drew more attention, and representatives held Congressional Hearings to learn more about the technology and the plans for its use in the consumer sector.

III. COMMITTEE HEARINGS

In July 2004, the Subcommittee on Commerce, Trade and Consumer Protection (the Committee) held hearings to gather information about RFID technology and the plans for its use in consumer commerce. (21) Several witnesses testified to the Committee, including those in favor of the technology and those who expressed concerns related to the use of RFID. While supporters of RFID stressed its economic benefits and efficiency, opponents cautioned the Committee to be wary of privacy issues, especially in the retail setting. Several witnesses were present to explain the value of RFID on behalf of the proponents of the technology. When testifying in favor of its implementation, it is significant that the proponents of the technology focused on the use of RFID tags on containers and not individual items. (22)

Dr. Sanjay Sarma, associate professor of mechanical engineering at the Massachusetts Institute of Technology, said that "[i]n this network, inanimate objects--chiefly pallets or cases of manufactured goods--will have the ability to be identified wherever they are." (23) He went on to say that u[c]onsumers will benefit from increased product availability and faster removal of recalled products." (24) He also pointed out that RFID "represents an enormous advance over bar code technology" because it "does not require that objects be within the line of sight of the device needed to detect them." (25) He then explained the features of the Electronic Product Code (EPC) system, which provides for a unique identifier found on RFID tags. In fact, he stated that "[t]he EPC can then be matched to the specific product information contained in a corresponding database." (26) He further described how the EPC system has the capability to reveal more information about an RFID tag, "such as when it was made and shipped, what lot it came from, and other important information related to the movement of global commerce." (27) Keep in mind that Dr. Sarma emphasized the …